quasar | 50a0b3ec3dcbd75e5e0aa49632f6efc5d3392c892d04ef4fa3ddf10573eebdbd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260408-dw4b2af16n
SHA256 50a0b3ec3dcbd75e5e0aa49632f6efc5d3392c892d04ef4fa3ddf10573eebdbd
MD5 d81f9566b58c39cabc21dfe291b3ca6b
SHA1 d3231c2abfd8e6c66547e36f67af000d705bfa33
SHA512 af12a4d66379a56641c48dfc64d93c113c827c92f8fcd5770e728f8fab27641d665fa6e9247bf28e07233ea2ed13ffce12293f550091b7fdbb0756543fb07b39
SSDEEP 49152:MyhJJHPNCC7J98vBgJh99oG4znXpQxUuxGkTHHB72eh2NT:MyhrHPh7J98vGJh99t5x
TLSH
T15CE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilacztd.tv
malware.xoilacztd.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3964-0-0x0000000000F60000-0x000000000128C000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	messenger_update.exe
Token: SeDebugPrivilege	4288	messenger_update.exe
Token: SeDebugPrivilege	1164	messenger_update.exe
Token: SeDebugPrivilege	2552	messenger_update.exe
Token: SeDebugPrivilege	4608	messenger_update.exe
Token: SeDebugPrivilege	3080	messenger_update.exe
Token: SeDebugPrivilege	904	messenger_update.exe
Token: SeDebugPrivilege	3488	messenger_update.exe
Token: SeDebugPrivilege	1640	messenger_update.exe
Token: SeDebugPrivilege	4132	messenger_update.exe
Token: SeDebugPrivilege	4244	messenger_update.exe
Token: SeDebugPrivilege	2884	messenger_update.exe
Token: SeDebugPrivilege	4432	messenger_update.exe
Token: SeDebugPrivilege	4356	messenger_update.exe
Token: SeDebugPrivilege	3500	messenger_update.exe
Token: SeDebugPrivilege	5004	messenger_update.exe
Token: SeDebugPrivilege	2776	messenger_update.exe
Token: SeDebugPrivilege	1716	messenger_update.exe
Token: SeDebugPrivilege	3744	messenger_update.exe
Token: SeDebugPrivilege	244	messenger_update.exe
Token: SeDebugPrivilege	1492	messenger_update.exe
Token: SeDebugPrivilege	2604	messenger_update.exe
Token: SeDebugPrivilege	1484	messenger_update.exe
Token: SeDebugPrivilege	4892	messenger_update.exe
Token: SeDebugPrivilege	3144	messenger_update.exe
Token: SeDebugPrivilege	3012	messenger_update.exe
Token: SeDebugPrivilege	4020	messenger_update.exe
Token: SeDebugPrivilege	2036	messenger_update.exe
Token: SeDebugPrivilege	400	messenger_update.exe
Token: SeDebugPrivilege	3068	messenger_update.exe
Token: SeDebugPrivilege	3668	messenger_update.exe
Token: SeDebugPrivilege	2020	messenger_update.exe
Token: SeDebugPrivilege	2100	messenger_update.exe
Token: SeDebugPrivilege	4684	messenger_update.exe
Token: SeDebugPrivilege	484	messenger_update.exe
Token: SeDebugPrivilege	736	messenger_update.exe
Token: SeDebugPrivilege	2932	messenger_update.exe
Token: SeDebugPrivilege	4148	messenger_update.exe
Token: SeDebugPrivilege	4840	messenger_update.exe
Token: SeDebugPrivilege	552	messenger_update.exe
Token: SeDebugPrivilege	2760	messenger_update.exe
Token: SeDebugPrivilege	600	messenger_update.exe
Token: SeDebugPrivilege	2888	messenger_update.exe
Token: SeDebugPrivilege	2868	messenger_update.exe
Token: SeDebugPrivilege	2148	messenger_update.exe
Token: SeDebugPrivilege	1436	messenger_update.exe
Token: SeDebugPrivilege	3420	messenger_update.exe
Token: SeDebugPrivilege	4904	messenger_update.exe
Token: SeDebugPrivilege	420	messenger_update.exe
Token: SeDebugPrivilege	2060	messenger_update.exe
Token: SeDebugPrivilege	5076	messenger_update.exe
Token: SeDebugPrivilege	3884	messenger_update.exe
Token: SeDebugPrivilege	2212	messenger_update.exe
Token: SeDebugPrivilege	3512	messenger_update.exe
Token: SeDebugPrivilege	1200	messenger_update.exe
Token: SeDebugPrivilege	3348	messenger_update.exe
Token: SeDebugPrivilege	3408	messenger_update.exe
Token: SeDebugPrivilege	3032	messenger_update.exe
Token: SeDebugPrivilege	1792	messenger_update.exe
Token: SeDebugPrivilege	4908	messenger_update.exe
Token: SeDebugPrivilege	2272	messenger_update.exe
Token: SeDebugPrivilege	2296	messenger_update.exe
Token: SeDebugPrivilege	3196	messenger_update.exe
Token: SeDebugPrivilege	4296	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4188	3964	messenger_update.exe	79
PID 4188 wrote to memory of 4444	4188	cmd.exe	81
PID 4188 wrote to memory of 4288	4188	cmd.exe	82
PID 4288 wrote to memory of 1284	4288	messenger_update.exe	83
PID 1284 wrote to memory of 5112	1284	cmd.exe	85
PID 1284 wrote to memory of 1164	1284	cmd.exe	86
PID 1164 wrote to memory of 3044	1164	messenger_update.exe	87
PID 3044 wrote to memory of 4888	3044	cmd.exe	89
PID 3044 wrote to memory of 2552	3044	cmd.exe	90
PID 2552 wrote to memory of 3984	2552	messenger_update.exe	91
PID 3984 wrote to memory of 4656	3984	cmd.exe	93
PID 3984 wrote to memory of 4608	3984	cmd.exe	94
PID 4608 wrote to memory of 4868	4608	messenger_update.exe	95
PID 4868 wrote to memory of 1548	4868	cmd.exe	97
PID 4868 wrote to memory of 3080	4868	cmd.exe	98
PID 3080 wrote to memory of 4044	3080	messenger_update.exe	99
PID 4044 wrote to memory of 3512	4044	cmd.exe	101
PID 4044 wrote to memory of 904	4044	cmd.exe	102
PID 904 wrote to memory of 4968	904	messenger_update.exe	103
PID 4968 wrote to memory of 244	4968	cmd.exe	105
PID 4968 wrote to memory of 3488	4968	cmd.exe	106
PID 3488 wrote to memory of 1516	3488	messenger_update.exe	107
PID 1516 wrote to memory of 3200	1516	cmd.exe	109
PID 1516 wrote to memory of 1640	1516	cmd.exe	110
PID 1640 wrote to memory of 1724	1640	messenger_update.exe	111
PID 1724 wrote to memory of 3240	1724	cmd.exe	113
PID 1724 wrote to memory of 4132	1724	cmd.exe	114
PID 4132 wrote to memory of 4948	4132	messenger_update.exe	115
PID 4948 wrote to memory of 876	4948	cmd.exe	117
PID 4948 wrote to memory of 4244	4948	cmd.exe	118
PID 4244 wrote to memory of 4500	4244	messenger_update.exe	119
PID 4500 wrote to memory of 4644	4500	cmd.exe	121
PID 4500 wrote to memory of 2884	4500	cmd.exe	122
PID 2884 wrote to memory of 3016	2884	messenger_update.exe	123
PID 3016 wrote to memory of 3144	3016	cmd.exe	125
PID 3016 wrote to memory of 4432	3016	cmd.exe	126
PID 4432 wrote to memory of 2800	4432	messenger_update.exe	127
PID 2800 wrote to memory of 776	2800	cmd.exe	129
PID 2800 wrote to memory of 4356	2800	cmd.exe	130
PID 4356 wrote to memory of 4792	4356	messenger_update.exe	131
PID 4792 wrote to memory of 3264	4792	cmd.exe	133
PID 4792 wrote to memory of 3500	4792	cmd.exe	134
PID 3500 wrote to memory of 3732	3500	messenger_update.exe	135
PID 3732 wrote to memory of 4196	3732	cmd.exe	137
PID 3732 wrote to memory of 5004	3732	cmd.exe	138
PID 5004 wrote to memory of 4900	5004	messenger_update.exe	139
PID 4900 wrote to memory of 4284	4900	cmd.exe	141
PID 4900 wrote to memory of 2776	4900	cmd.exe	142
PID 2776 wrote to memory of 4776	2776	messenger_update.exe	143
PID 4776 wrote to memory of 1844	4776	cmd.exe	145
PID 4776 wrote to memory of 1716	4776	cmd.exe	146
PID 1716 wrote to memory of 4652	1716	messenger_update.exe	147
PID 4652 wrote to memory of 2592	4652	cmd.exe	149
PID 4652 wrote to memory of 3744	4652	cmd.exe	150
PID 3744 wrote to memory of 5116	3744	messenger_update.exe	151
PID 5116 wrote to memory of 232	5116	cmd.exe	153
PID 5116 wrote to memory of 244	5116	cmd.exe	154
PID 244 wrote to memory of 3680	244	messenger_update.exe	155
PID 3680 wrote to memory of 1728	3680	cmd.exe	157
PID 3680 wrote to memory of 1492	3680	cmd.exe	158
PID 1492 wrote to memory of 2340	1492	messenger_update.exe	159
PID 2340 wrote to memory of 4808	2340	cmd.exe	161
PID 2340 wrote to memory of 2604	2340	cmd.exe	162
PID 2604 wrote to memory of 4360	2604	messenger_update.exe	163

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LIKurmDrHvdJ.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OdD82ZKXP4rW.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oLjOCpzwWZJt.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQDzajOSPBJj.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oBRtfQU9LyC4.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c7MZWf3Bb5QU.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uYkkuJrRsCsd.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YQyJDdkbdiLF.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z9H2FWMBc3PN.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mSUPO72TaE7m.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ODh3jAa7fOAK.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XNaaTBgZ1E2t.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jvt4DoRX5uIh.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IZXCuYoJAZmr.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X6K7YE6lrvmW.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAF04nHOY48H.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9m5XY92vlhTc.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7uYppaH1yr01.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AB9q9Y7bWCXa.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oT4tXgtyO5nc.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GXwhAIZ9dkzE.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MdQWTKkmv8Hz.bat" "
        44⤵
        
        PID:4360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0iCH23KZJl0V.bat" "
        46⤵
        
        PID:5072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FcNgcTLazsIQ.bat" "
        48⤵
        
        PID:2156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IX8Vk8Fpn9BW.bat" "
        50⤵
        
        PID:4940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGKA5xygF6dw.bat" "
        52⤵
        
        PID:972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AV8Bh1sMbwY3.bat" "
        54⤵
        
        PID:2292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cR0sDppnB5Ze.bat" "
        56⤵
        
        PID:684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Eul8mahoaDnX.bat" "
        58⤵
        
        PID:2096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YbrTw3hKNFoj.bat" "
        60⤵
        
        PID:2436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3O1Brrm6X68R.bat" "
        62⤵
        
        PID:1176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FjpEzV7pqELy.bat" "
        64⤵
        
        PID:2088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSQ7LyPjLN2l.bat" "
        66⤵
        
        PID:1628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUBen0GncYLF.bat" "
        68⤵
        
        PID:4100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q8XzaqZS8T3Q.bat" "
        70⤵
        
        PID:1684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSzcI7vTfpxT.bat" "
        72⤵
        
        PID:4628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wNB5k3SvPV2l.bat" "
        74⤵
        
        PID:5024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4OSsRsGe4aTz.bat" "
        76⤵
        
        PID:4060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SSO0F6qUzSPV.bat" "
        78⤵
        
        PID:3940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ziaNedliAcgy.bat" "
        80⤵
        
        PID:1756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hu884OOqWZrx.bat" "
        82⤵
        
        PID:4024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZmFI15JbnNBT.bat" "
        84⤵
        
        PID:3580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yP5OUlfnossE.bat" "
        86⤵
        
        PID:1868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r5bv3McpKnHW.bat" "
        88⤵
        
        PID:3664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SwbhaS5dX7hw.bat" "
        90⤵
        
        PID:1488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YIIx8Coebz8C.bat" "
        92⤵
        
        PID:2128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCTnXLbDicEj.bat" "
        94⤵
        
        PID:2440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\605GDFuNLLKh.bat" "
        96⤵
        
        PID:3596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JceWwVRWH62y.bat" "
        98⤵
        
        PID:3756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iPX7nfaB8SAj.bat" "
        100⤵
        
        PID:5068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\veCCR7CzX7lS.bat" "
        102⤵
        
        PID:656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CIECekN5zYba.bat" "
        104⤵
        
        PID:2744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XB8Di3n9RX5w.bat" "
        106⤵
        
        PID:1180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0Im9DvpyJUBV.bat" "
        108⤵
        
        PID:4292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        109⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tjykLNraQwKu.bat" "
        110⤵
        
        PID:3944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        111⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8KV66DlKRb46.bat" "
        112⤵
        
        PID:1264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        113⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7DYK6qu46fVi.bat" "
        114⤵
        
        PID:3904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        115⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yru4bb0JLSHP.bat" "
        116⤵
        
        PID:2668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        117⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GXU4N5X0mfm4.bat" "
        118⤵
        
        PID:1524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        119⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UoVlBXg79sFF.bat" "
        120⤵
        
        PID:4588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        121⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CHqwhRngg2qS.bat" "
        122⤵
        
        PID:576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        123⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYD7wjvcchei.bat" "
        124⤵
        
        PID:880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        125⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UYPL8wXSbneR.bat" "
        126⤵
        
        PID:1280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        127⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gqi8yrHkTzli.bat" "
        128⤵
        
        PID:3816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        129⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        129⤵
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7WY1KtUElD5p.bat" "
        130⤵
        
        PID:228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        131⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        131⤵
        
        PID:3612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wjAorYvhcYDd.bat" "
        132⤵
        
        PID:1728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        133⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        133⤵
        
        PID:2544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gocO0eHDw6x8.bat" "
        134⤵
        
        PID:3284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        135⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        135⤵
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gpOvz6ueOZDT.bat" "
        136⤵
        
        PID:5084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        137⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        137⤵
        
        PID:1660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tuewhHoHgIzA.bat" "
        138⤵
        
        PID:1076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        139⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        139⤵
        
        PID:1220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EsXcXlzQXHVL.bat" "
        140⤵
        
        PID:2140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        141⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        141⤵
        
        PID:3280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WkJIerzc0R5l.bat" "
        142⤵
        
        PID:4040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        143⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        143⤵
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YHpxSkaMFMAO.bat" "
        144⤵
        
        PID:3700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        145⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        145⤵
        
        PID:1148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D0s2SIVbcRQK.bat" "
        146⤵
        
        PID:4936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        147⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        147⤵
        
        PID:4740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kfSico2yBrsz.bat" "
        148⤵
        
        PID:5036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        149⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        149⤵
        
        PID:4932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PbkyEPpwFjzr.bat" "
        150⤵
        
        PID:1460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        151⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        151⤵
        
        PID:2484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hDilv5epzUfV.bat" "
        152⤵
        
        PID:2172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        153⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        153⤵
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xs9cT9Xbr9X2.bat" "
        154⤵
        
        PID:2040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        155⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        155⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CnIG7aC6hG5F.bat" "
        156⤵
        
        PID:4600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        157⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        157⤵
        
        PID:2228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQSAC1M6j08Z.bat" "
        158⤵
        
        PID:3112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        159⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        159⤵
        
        PID:4972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qdfRZzCbJ3ws.bat" "
        160⤵
        
        PID:5012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        161⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        161⤵
        
        PID:4996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKx1drVOchkB.bat" "
        162⤵
        
        PID:4896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        163⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        163⤵
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MjFD7JhBWwNb.bat" "
        164⤵
        
        PID:4784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        165⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        165⤵
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XTIJ0g0gct91.bat" "
        166⤵
        
        PID:3096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        167⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        167⤵
        
        PID:1496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ys7Ia77z0V1q.bat" "
        168⤵
        
        PID:72
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        169⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        169⤵
        
        PID:2352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3wITeyQYtzMY.bat" "
        170⤵
        
        PID:4332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        171⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        171⤵
        
        PID:2736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xV9tITEmiPvg.bat" "
        172⤵
        
        PID:2824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        173⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        173⤵
        
        PID:3168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TbEGXvHrK2Ws.bat" "
        174⤵
        
        PID:4788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        175⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        175⤵
        
        PID:2428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NeOIFRQHk1XH.bat" "
        176⤵
        
        PID:4196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        177⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        177⤵
        
        PID:2660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QtchoTflg4zt.bat" "
        178⤵
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        179⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        179⤵
        
        PID:4172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nh6Jkqci8JCj.bat" "
        180⤵
        
        PID:744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        181⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        181⤵
        
        PID:2488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6yPB66CoLNxJ.bat" "
        182⤵
        
        PID:1832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        183⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        183⤵
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C4VvSpqy0F3c.bat" "
        184⤵
        
        PID:3092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        185⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        185⤵
        
        PID:1936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ncozu3ruFktL.bat" "
        186⤵
        
        PID:2116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        187⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        187⤵
        
        PID:3200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u10ZyFrIKQ8n.bat" "
        188⤵
        
        PID:2388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        189⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        189⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMn73XXU2y1o.bat" "
        190⤵
        
        PID:768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        191⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        191⤵
        
        PID:564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wRCniLlblm2H.bat" "
        192⤵
        
        PID:3900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        193⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        193⤵
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jkhjK6h9LPxP.bat" "
        194⤵
        
        PID:3988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        195⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        195⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y3DLSXP6AwGd.bat" "
        196⤵
        
        PID:3828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        197⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        197⤵
        
        PID:3372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UnzcgCKwG0m0.bat" "
        198⤵
        
        PID:4880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        199⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        199⤵
        
        PID:196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwMci2gEM2vp.bat" "
        200⤵
        
        PID:1996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        201⤵
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        201⤵
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qesFaN3MplJI.bat" "
        202⤵
        
        PID:3728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        203⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        203⤵
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N3pRTGVtlro1.bat" "
        204⤵
        
        PID:4120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        205⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        205⤵
        
        PID:4884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a5Mc2uBJpkFV.bat" "
        206⤵
        
        PID:4504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        207⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        207⤵
        
        PID:4404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cVdb4BqRGnnb.bat" "
        208⤵
        
        PID:1036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        209⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        209⤵
        
        PID:3912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hDPg7HkVBMj2.bat" "
        210⤵
        
        PID:644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        211⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        211⤵
        
        PID:1128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uLO6oLppfdcQ.bat" "
        212⤵
        
        PID:3676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        213⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        213⤵
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7eZ0IpiGn5dd.bat" "
        214⤵
        
        PID:2832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        215⤵
        
        PID:128
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        215⤵
        
        PID:2076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7aHmwKB6Pxcc.bat" "
        216⤵
        
        PID:3928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        217⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        217⤵
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t9DAx9iuelID.bat" "
        218⤵
        
        PID:1596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        219⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        219⤵
        
        PID:1668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KF1uvugO2bDu.bat" "
        220⤵
        
        PID:4112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        221⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        221⤵
        
        PID:1448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x0vk63QeY0MY.bat" "
        222⤵
        
        PID:3264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        223⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        223⤵
        
        PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

0Im9DvpyJUBV.bat

Path C:\Users\Admin\AppData\Local\Temp\0Im9DvpyJUBV.bat
Size 185B
SHA256 97624ab5324fcadb689b04d62726cfd7ead1641907bc74604d0f4159a94945f4
MD5 cf816a323cfeba19cb41735180bc6504
SHA1 cf5602ced2f612c83c07ad9da1f4451506f0488a
SHA512 a0059a3e7e604787494f53facd64e9bea773bbb11e86876b3f20f6bf534aa2aed2076c2230ec402dc9842d9ab049406b12f39122e942665ad525883e4a00458e
TLSH
T14DC0120141818A6E49045D0A59AAB6CCF19509A929497FA04511886D63D2CA8B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

0iCH23KZJl0V.bat

Path C:\Users\Admin\AppData\Local\Temp\0iCH23KZJl0V.bat
Size 185B
SHA256 3be18966ac17f0bd77b19beb19e82a76751be45f13bdc7c9c376d11991034e7c
MD5 528acd5744e3ffb3fcd3d8b7a1555dd4
SHA1 b2dfac6d0506dd044b6862ebbf40b5ceacf3e23a
SHA512 89838d5b45f7aa6ce3b1dc2e4f0b46daef7ab5e585e254cc904e292837c7f944b66eba2e34938bbecbebb4498f01e50b4209ac8eb364f7686435b40073547da4
TLSH
T127C0120181968A5E49145C0A19A9678CF1D509992A497FA58601889D53D3C68B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

3O1Brrm6X68R.bat

Path C:\Users\Admin\AppData\Local\Temp\3O1Brrm6X68R.bat
Size 185B
SHA256 8c0605671e4115d645b9fb40f4faf699f3d0593e3ba5a3068ec74f7077de48ff
MD5 ac6581a6cfe58f003d3a951eda8c11e7
SHA1 b36bbf1365dbc01553f8b018579accf82db9f5fa
SHA512 e9f75b8b67f10d3568d9557be03528ad7954b3124aade4bd409df984f8a03eae5b3ecb8fa4444ebcc45433a24a94ceadb5315361ae7fb23f255709f3e904ccde
TLSH
T181C0120191828A6F46045C0A19A9B68CF0D508DD2A497FA04911CC5C53E3C5DB9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

4OSsRsGe4aTz.bat

Path C:\Users\Admin\AppData\Local\Temp\4OSsRsGe4aTz.bat
Size 185B
SHA256 99d946233168d2757e1521499a013cf78279864dd4e0a2c1b5e3930418a967b6
MD5 55debfd8d77384fa5c35b43b52362ba5
SHA1 b0630bfeff7ccce5921031bec3aba596a2f0923d
SHA512 dcc6eb268d28a621dffdbbbd00e9e4d23af7982e0068c4efe665901c10a37686f6e75881bade2216dda412c4a67ef0c764bbdfd5d64d93af551e940462cae219
TLSH
T1A2C0120141858A5E55045C1B19E966CCF09509A92A897FA44501C85D53D2C5CB9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

605GDFuNLLKh.bat

Path C:\Users\Admin\AppData\Local\Temp\605GDFuNLLKh.bat
Size 185B
SHA256 f4e468009bb5de02c736e952cb29f2c159edd0330d21c52c558f9b98f6b9a9cb
MD5 cbc2333854dc2f83493b858bb54b66b1
SHA1 c07d004a485d6251e49f1e2626d35d7f8f8f9b50
SHA512 284bac5dfb8220fa32a0cef2b4fe3ffbe64b9aaf05141bcbc5043484708dd591ce234be982b7d128f74cbb66d2d5a698705ba7b5a916112e17066cd1a6c05e63
TLSH
T120C0120151818A5E45049C1A19A9668CF0A609A96D497FA04A01885C53D2C58B9DB7D6
MD5 SHA1 SHA512 TLSH

Submit Download

7DYK6qu46fVi.bat

Path C:\Users\Admin\AppData\Local\Temp\7DYK6qu46fVi.bat
Size 185B
SHA256 ab3c517735d591743d968307c811829a18895f7fecfcc2e900547309ec9258ff
MD5 93911507db343bb1a67a660366c689ad
SHA1 9b1a16921a5527622e30f93e83e260b5e48ca43a
SHA512 73244f9ffae84e31657eace615d7056d43101ed6f7af97bbaf8ef1360807096fb9742802fbbe53082145170352f516b2b00889c967b1c5db60d5179a8862a693
TLSH
T181C0120196818A5E45246C0B59EA678CF0D909996D497FA045418C5C23DAC68B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

7uYppaH1yr01.bat

Path C:\Users\Admin\AppData\Local\Temp\7uYppaH1yr01.bat
Size 185B
SHA256 92ce82f72ed93e30f3a384de4eb6f52ec87c98118efffd1670255bb8a6d56238
MD5 684c165a1b63c41296159aa92c76071f
SHA1 cc985baf25c2447dd48773596045012117ec43c1
SHA512 d62fb9856a3c01e290ad29ff45c0a2634e3db1c0194f780b41cb36f5954199d242cbc364975e494d3bb28b23115e6f716395c290da5ee4e85725c7ed49ae146f
TLSH
T1B6C012024681CE5E4A145C1A19A9A68CF09609992A497FA04541CC5C53D2C9CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

8KV66DlKRb46.bat

Path C:\Users\Admin\AppData\Local\Temp\8KV66DlKRb46.bat
Size 185B
SHA256 03e7dc285ba11b749bdea0f11e4f222c02f4ffab248beedb6159dac96f1dfee5
MD5 154c72d71c0ac81dc455cbb1a9910f74
SHA1 431d4ffe11a297cd92887232eebfbdbb66d1f822
SHA512 3e9ce85aad95c4ec73a05eececd52b10bd13282606f24fc2cdbf607440fe575b89f0199dba4e0ddaa0dbcc557e5216da9e9b3a1fa36e9b6c87a065af6af94f6d
TLSH
T1E1C01201A181CA6F55445D1A19EAA78CF0E508AD69497FA44501C85C13D2C58B9CB783
MD5 SHA1 SHA512 TLSH

Submit Download

9m5XY92vlhTc.bat

Path C:\Users\Admin\AppData\Local\Temp\9m5XY92vlhTc.bat
Size 185B
SHA256 7a6e970ff646df62190f62052fe6a11689aeef354fdd2f3ff203f3086bf58b6b
MD5 9af7704b0b0976bee02a8accba0050aa
SHA1 7fd9524ae3cccb2c31f584beedc974b064f058e2
SHA512 36ba6b9953d874785247e223e98bb997cb70ff1acb5ec080f7e5d63e6dfea7f84ff9dd9f63f1d7df11e73c466c5166f84365de6343fab6df8ec0c9e1f7674367
TLSH
T12CC012018181CA5E46045C0A19A9668DF09508992A497FB5454188AC63E2C99B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

AB9q9Y7bWCXa.bat

Path C:\Users\Admin\AppData\Local\Temp\AB9q9Y7bWCXa.bat
Size 185B
SHA256 26d86af36d38d2d740e94a76e7929227ee6080e874b8453e58007933b96a443e
MD5 ca40966c932d747aa89c479788d84aac
SHA1 10b82e787651ddaa6ab9cef9ee846eed793331bd
SHA512 ac8cc308e0e71f3c7fd94f42194f11f6536c1afdaff1105451c5424e8500a9d5fc769904eff09eca923997e75bb3e1eb421c9eff1097ea92728389c52e79e81b
TLSH
T148C012015181CA5E45045C0A19A967CCF0A909AD2949BFB146128C9C57D2C98B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

AV8Bh1sMbwY3.bat

Path C:\Users\Admin\AppData\Local\Temp\AV8Bh1sMbwY3.bat
Size 185B
SHA256 05dae2ba78866d0afd626576a8a573fb541badcc7cbb24350eafab7f85e328d2
MD5 c5b9274220abd38a223ac3aab9da6556
SHA1 bbd88b70fd5cdb1e75b5ff3f3711280c8e7ebdd4
SHA512 68bbce879b126d1b33c4902e2ada927a506d4163c329afbe5b5134da9877cd1989ddbc6b9b9db56ed9250def7b7aa1a535e56dca7b8045180310d172a11666a4
TLSH
T170C012014585CA5E55045C1A19AEA7CCF09509992D497FA049018C5C13D3C59B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

CAF04nHOY48H.bat

Path C:\Users\Admin\AppData\Local\Temp\CAF04nHOY48H.bat
Size 185B
SHA256 5dc204dbba8384a89ad9bcd007a67c1a972078ce1af8dd70fbbe1989df432c76
MD5 471c9c6b874efa869bb65597d55048da
SHA1 08dc0fd1751b2e8e18873681e18f7832c1237ad5
SHA512 d8d99df273ba6d853dd718f22b2ea0a9a161e38e4b0a3dba21034a31998b085c822827ff303198c3dee1089924e7a3c4b9e9b20e1391da1b4fb1183deb9e46fc
TLSH
T1F0C0120142818A5E46145C1A59B9668CF19508992A497FA04605C85C13D2C98B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

CHqwhRngg2qS.bat

Path C:\Users\Admin\AppData\Local\Temp\CHqwhRngg2qS.bat
Size 185B
SHA256 b1d6df1d84a61429cd1f6dfe82474ecbbd058c0fe3444b9986d8af170029d19f
MD5 b453079682777261566f850cecbf5201
SHA1 a2281c42c84d407df616def713db358f0bc02cc9
SHA512 d0cd21e6897703edf4a55f1235bc6b8fb8f1ad1bd7f402ab16b057d7c2ebd9a8ef12d7c08febe2ed3a8998eaf9c5dbc8f32080391fe1117e173ddea9f8be7fcf
TLSH
T142C0120141818A7E46585C0B59A9B68CF099089D2949BFA44901C85D13D3C9DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

CIECekN5zYba.bat

Path C:\Users\Admin\AppData\Local\Temp\CIECekN5zYba.bat
Size 185B
SHA256 c1c51f2e892bb5f4e0dc481cc8aac11646408b47684cce388166fb79d1ee9048
MD5 a3d4013d55098cd2c42f29b696c7ddc2
SHA1 ccecc382e96f556a19b0af17a2e1cc5602eee723
SHA512 2d5b6216c74f0b54ea8aedf0fb7a6931397eb92b1db3a3abdb3850507fb0963bfad831ff697523905594e3c4fe74e4ed70bfc73ece6bb1ae5c06cf16b82fdef6
TLSH
T16BC022008181CA1E86000C1A18AA728CF0A5089C2D487FA54901884C13C3C58B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

Eul8mahoaDnX.bat

Path C:\Users\Admin\AppData\Local\Temp\Eul8mahoaDnX.bat
Size 185B
SHA256 17e685fcfb6d38378e5f3e13f52ad231bfc89293c08e2d9a08703664c1d9ec6e
MD5 0ce3b79f28e93cdb20a948e52584b2af
SHA1 9f9c82432fad5070749584d0387eae886305a4f9
SHA512 b94e914bc27f6c7d32fe0cc6114861f9c44516ebf129c4a684f69b1f20993d7285455629ffd2c6caf7420b0f3cf3a033acb174a4602a619e4d02b830847ef0ca
TLSH
T1DDC0124151958A9E45045C0B19A9A68CF0E508AD6949BFA04A01C86C53D6C9CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

FcNgcTLazsIQ.bat

Path C:\Users\Admin\AppData\Local\Temp\FcNgcTLazsIQ.bat
Size 185B
SHA256 aaae4dc1ed72cc1a3874bbfe09754957b8a25d530eb59399dd51ccc45837d870
MD5 ff0d3cfafa08a3af6c73905a1fcc4a96
SHA1 32735cf7dedcd39799aa709e7186a2032394cccc
SHA512 1479237363e2d3db4c42f3c941c83c24e33737a124c64e1da3622b46608da89cde2f40a64bb7fb56f76d7bfa6980c484f1ea181b09764936b6dcbd2dc8a83464
TLSH
T193C012014281CA5E4A145C1A29AA768CF19909AD2949BFA04601885D13D6C5DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

FjpEzV7pqELy.bat

Path C:\Users\Admin\AppData\Local\Temp\FjpEzV7pqELy.bat
Size 185B
SHA256 528ed3bbf60b6b5e6883c2a2376cbe9fb00eae388b2e39a044164ce4777f6148
MD5 05abb1974e4f010146de37d8fd099f8c
SHA1 f0d60155fc62cb8f0f4b23fc9c4c5373a18f1548
SHA512 7c2b6dd81e396b8796c7878e796f3e774464ca3f1f4c5e25abeef7972a0d64f788853e28e2cf5446dd9b056b69d5fcf1c1177267b9155ca388ccb4138b96e21c
TLSH
T175C0120151818A5E46055C0A19A9668CF095099D2A497FA44511C85D17D6C58B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

GXU4N5X0mfm4.bat

Path C:\Users\Admin\AppData\Local\Temp\GXU4N5X0mfm4.bat
Size 185B
SHA256 c08681e185f169f0baf22c24b4ee538cd5a3027660948471303fb7ccfdb8e7df
MD5 71b1b9de42d97ec7db6b978c24bc37c7
SHA1 2d725544bb66101f5d7a8310e3395b0d21a1438f
SHA512 2379152ef80802cae7603e820f98bf4e5c2d55f4fea212f2265af1c8c9bed1423fd55c3e548e7994035366c579cef5a9036ce150224b2100b44ad76180e97af2
TLSH
T173C0120146818A5E49045C0A59A9BACCF0D908AA29497FA44501885C67D2C59B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

GXwhAIZ9dkzE.bat

Path C:\Users\Admin\AppData\Local\Temp\GXwhAIZ9dkzE.bat
Size 185B
SHA256 951dcd02bfd3c541faf44b150e34e4e29a6fd4dd5caf7d90833e5489a54889c2
MD5 d553091c1435fbcf2474d1764c7b98af
SHA1 c9dc076673ee6028e03c87c240fb06495e3b626e
SHA512 140a226ffa610d962a1b8fae9c4d8c2bb4b90ddd52c2f425ab42bbc95411c8dcd99ff9f72f7c664acd3f859fb4f16e15275d5c54ce88c2551677cfd3bc3c2fa8
TLSH
T135C012015181CA5E55045C1A19AA66CCF09908AA2A497FB14A15889D13D2C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Hu884OOqWZrx.bat

Path C:\Users\Admin\AppData\Local\Temp\Hu884OOqWZrx.bat
Size 185B
SHA256 796d0b5b7e8c2b089191b86f64dee183df3364d30d2deb191af2107613515960
MD5 26ad1976c58170c321beacc8d9b8d769
SHA1 3f04c3ce1245eb199b5e8d03404673a92582e8b0
SHA512 464c7c38e800f3879ca51ad623314af24e386546686ab1b6e735af2ad402e9f21d82971d3a8b825f284cbbb3ba1f94a98efbc1357d5c2c04f49868b84003777b
TLSH
T10DC01201C1828A5E45045C0A19A9778CF196099929497FA04511CC5C13D3C9DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

IX8Vk8Fpn9BW.bat

Path C:\Users\Admin\AppData\Local\Temp\IX8Vk8Fpn9BW.bat
Size 185B
SHA256 333e37978c122d3c538465bf4f2e0cfd08e695f5b62127f1f6cb25b9326a79b5
MD5 a942533e0fd7d0f7dfcd4582ace5b7a0
SHA1 feef39213a02b3930f34535e8792ea203a4ad860
SHA512 224b9937b433ef9ecbd448e8e932948c65cc7ccd4d25e197523f8b78e5974974d4dc3db311840bab46d8cb72d519445adae83a354db4aea4b0bd3a49dfb01fb1
TLSH
T1B2C0120141C18AAE49045C0A19A9678CF0950C9A2D897FA44901885C17D3C59B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

IZXCuYoJAZmr.bat

Path C:\Users\Admin\AppData\Local\Temp\IZXCuYoJAZmr.bat
Size 185B
SHA256 12bf16059dbdb9eac9d80dcce76a73d9d1868638a1c418e27319632e46da19b5
MD5 4fb42fd2886806ddcc8801da33afb493
SHA1 957fcc058c1f621f8d24bcaf2ec297e67c7a3048
SHA512 7f8cf02ba3fc12c2ffdfd0ecd4f65ba097786c707f5de3752510bd50a0df552bfffe7bf0571e7dc448794e26c5a7dd8c78303a187ec0f6dcc16cea589603559d
TLSH
T1E7C0120192858A6E45245C0B19B9778CF199089D6D497FA04641885C57D2C5DB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

JceWwVRWH62y.bat

Path C:\Users\Admin\AppData\Local\Temp\JceWwVRWH62y.bat
Size 185B
SHA256 a9a1e376865283876f5414d494e7078b54beae78021c6dd17330543d5ad2779e
MD5 df773655072658b0d44411559f20e12f
SHA1 f548085876ac1c8d325996be98eea6b715fb98e8
SHA512 7e2713e58b09f4c95092aecfd8e201699590f84efb8a1bb9f1d7cfbedba80ce943112348a361466934e7461db36ddd5821fe686be758f6eca932c184afa9f638
TLSH
T124C0120142828A5E46045C0A19AAA68CF095089929497FB08D118C5C13D6C99B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Jvt4DoRX5uIh.bat

Path C:\Users\Admin\AppData\Local\Temp\Jvt4DoRX5uIh.bat
Size 185B
SHA256 fdc54838dfe3779508a1e44d5f85203eac2814f59d3d13a882001fe70d11750a
MD5 ecdb09d8632c7499a1a4f5dc8a46a798
SHA1 c96837e5eef9ce00b1500cfdf2eec16ef26721de
SHA512 6532ccd0acf5c9c4499b89e9bf79c0e9a9674195bf4667ef0328944851d838955021f753fc3f2e1c831a088ee9a15f815b2480e041e9e4c3eb9317645ffc8b66
TLSH
T1B5C0120146828A5F45045C1A59A9A68CF09909D9AD497FA04A018C5C97D2C68B9CB7D3
MD5 SHA1 SHA512 TLSH

Submit Download

LIKurmDrHvdJ.bat

Path C:\Users\Admin\AppData\Local\Temp\LIKurmDrHvdJ.bat
Size 185B
SHA256 c2ac603783620bc21280ab18ea795c008eb5ca5fb7b38d421e41a1bdbef5dd12
MD5 32c3bd2f8d223dc736606466c927d048
SHA1 aa7f273d4639532e283963846740d733fe828a63
SHA512 9f7f9506dcb99ccab7fc314342ff21806e50b805bc62cb227c153efabc79c74b3889d5b517fafd544b87e90dfc3497f7a389ca4e68004844e0b4b02a7496eb64
TLSH
T1E3C012028181CA5E45045C0B1AA967CCF0D9089929497FA44911889C13D6C5DB9DB786
MD5 SHA1 SHA512 TLSH

Submit Download

MdQWTKkmv8Hz.bat

Path C:\Users\Admin\AppData\Local\Temp\MdQWTKkmv8Hz.bat
Size 185B
SHA256 eb167b607d7a4ab5b18cde67469dd10059cb0001af28e4c1d5393b37346c045e
MD5 4eb3608b20a7dd9f7da03d73ff9c6344
SHA1 24e4187e9a80d85995317a1a8b7ff1c805326c04
SHA512 10a677bb7f97d8da50c3057fbffbbb678e60fae8188d30971cfea875163952868ab3cb9d52c97dcd3a482effaabee2a395b402e52c7cb36bc3e7f4ae37a0f80e
TLSH
T14AC0120192858A6E45045C2B59AAA78CF0E508A92D497FE44511889D57E2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ODh3jAa7fOAK.bat

Path C:\Users\Admin\AppData\Local\Temp\ODh3jAa7fOAK.bat
Size 185B
SHA256 3f7a24bd0d989b85eba646b723607a3ec63fbdaba96405fd50d908d163e312c7
MD5 1bb5764dc1e877745ec8d7196e891df3
SHA1 42fa633024fa315dd34ee057122ded7c8b97a4c1
SHA512 22c470cb1fcfed587a090cefc2ea5fc7fae3ba29946e34470d0af6c10962c3dea17a1781538933d729b30b9e8eada505e6f091d383e7be2fa46e6e089b1f5a53
TLSH
T1E3C012018292CA6E45145C0A59A9668CF095089D2A497FA08941889D23D3C6DB9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

OdD82ZKXP4rW.bat

Path C:\Users\Admin\AppData\Local\Temp\OdD82ZKXP4rW.bat
Size 185B
SHA256 30af9a7a595653caba6e7c46d18db2a4ad2a51e14a2663fa7c9eda52036a418a
MD5 3146703ee7a9519e65dcf1bbb1a128af
SHA1 9662452790b24231853f070aa4bef38d99503d4f
SHA512 7d427a222dd1c631c1a4edbd358513f1ddacf81ac6b5469489b26a8bf297c54c5b16a8c403b1d21485a6614315810b27e7301a42a2edeaabe6dc71e3227c7caa
TLSH
T1E6C0120145818EAE45045C1A2DAAA68CF19508992E497FA04941885D13D7C98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

SSO0F6qUzSPV.bat

Path C:\Users\Admin\AppData\Local\Temp\SSO0F6qUzSPV.bat
Size 185B
SHA256 17e665be19cb460103eb0c560565662c1be92b7c712cd75e7519fc84b3d2dee3
MD5 bb278d75722b9c0465ac09c6fd88d18f
SHA1 609d20adc1350204be7624286701280bd90ab58a
SHA512 a3ce1fc01255482933880c0151aee84fb9622c3f63c57c71921416c9b873b0c7d151b5bd122c2f8b285d09c7dcba466b30c7bb21ac5a0441c0382645f90d08fc
TLSH
T14DC0120181928A5E45049C0A19E966CCF0D5099929497FA04601C85D23D2C68B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

SwbhaS5dX7hw.bat

Path C:\Users\Admin\AppData\Local\Temp\SwbhaS5dX7hw.bat
Size 185B
SHA256 88e99ae947fd9e639dd3052c49af6a604459751a813ed4425b35c43323abe94d
MD5 f3c3ed42de28cbecb38b28a221b9865b
SHA1 b7dcedec01919cff724992db3df40beb23e771c0
SHA512 3b8c01be67e58c972f3fab56be0dcbf806a12020c1c8357c580cfef0a249f42be4c866439c7d74268decfd79ec69d1ee9c4fb9091a60ce65d4f60ae137d9518a
TLSH
T12CC0120181C28A5E45145C0A59AA668CF095099D2D49BFA14501885D13D2C58B5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

TGKA5xygF6dw.bat

Path C:\Users\Admin\AppData\Local\Temp\TGKA5xygF6dw.bat
Size 185B
SHA256 f276d95b5f9ebc48a317fc945f951f3044d735d0e732dca2e1bb5f260e2bb10a
MD5 040af4beb98da0d3bc79b6581bdf9a49
SHA1 a5f9ac33067680b4af36cffac5be0a572b102f1e
SHA512 ca636c598188131e294c8efe7962e55a6ed1e579540334cc97e8e30a188cfd16853a1bbda5913008e874cdac45db8f6968903009c8f3f52dc19967edbb57c37d
TLSH
T1DAC012014582CA5E45045C0B19AA67CCF1D9089D39497FA049018C5C23D2C69B5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

TSzcI7vTfpxT.bat

Path C:\Users\Admin\AppData\Local\Temp\TSzcI7vTfpxT.bat
Size 185B
SHA256 61fc49b71837a3aeb5b9ddb952af5010036a3bea86f9b9d63cde4bc75ae1a3b4
MD5 0d827d1c717431ad4405cff5ec6a1876
SHA1 89e399fbf0d094cf862168af775021e70650f622
SHA512 d6c765c5aff718c17adabdbed6860e665a746c06490757e9f3c44bdeb850a1601cbe08f41a3019742be75d5e2a6bd77ca0784e2c10356af096f218ef19c8fb62
TLSH
T13DC0120181818A6E46045C4A19A9A6CCF1EA09992949BFA04911885C13D2C68B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

UYPL8wXSbneR.bat

Path C:\Users\Admin\AppData\Local\Temp\UYPL8wXSbneR.bat
Size 185B
SHA256 5f4218e07ebdc1f733ee73ac774d2e67e8465d88bce144d2790c18e5fa370b63
MD5 255e809747059d0f200b401b064a579f
SHA1 ba381cee94e46ed978fb6900ea60a8795c5cb8cc
SHA512 6a9a88318428206847dd8e0140198c57ca206ced77bde38b819283e1772b45357b38e69f6d073804344445c02fc044ab87084bea1c593b9f77ccf3a5070b8355
TLSH
T11AC0120151928E5E95045C0B19AA778CF1DB08992949BFA44511C85D13D2C59B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

UoVlBXg79sFF.bat

Path C:\Users\Admin\AppData\Local\Temp\UoVlBXg79sFF.bat
Size 185B
SHA256 4049017535cef0da46409b2ef6c37679abaa8a5e35fddb3939812f37ad8ff4af
MD5 7487f89afd44a1d946c3e349a98ded15
SHA1 805b482e880014b0ee4ed1a8c542f6a787e7ed1e
SHA512 fbf6f03e3543dd7fedc939b76f483810775677a25745c824fb3d6a4a5fa835043d6a62d8642ba152e8a58d9a1781eb86b334602110f27c53a08af1823925bd82
TLSH
T165C0120142C58A5E55146C0B19EAA78CF0E509A92949BFA04642885C13D3C58BDDF782
MD5 SHA1 SHA512 TLSH

Submit Download

X6K7YE6lrvmW.bat

Path C:\Users\Admin\AppData\Local\Temp\X6K7YE6lrvmW.bat
Size 185B
SHA256 17a47e76ce631f0179691a26498bb0b2103cecc55a0377c672757fdc12d5feeb
MD5 e5190bd69a9ad5bf2133f5bd9856ce5e
SHA1 e4103c16f8ffd88cd1f018c72e1658f30f641b4e
SHA512 48bf0e9a1ba97ea65ee0c3bec9141b4a6b8321802e5fd0682b47fb92906fdfe38071a80cbd452d1845ff10d675de18aff3b17512fd8cb4efbde835c1d4b6a894
TLSH
T179C0121151918A5E55045C0A59A9668CF195099969497FA04901985C17D3C68B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

XB8Di3n9RX5w.bat

Path C:\Users\Admin\AppData\Local\Temp\XB8Di3n9RX5w.bat
Size 185B
SHA256 7932e4f7bf34e3730a111254a7421f866d38438a8826d4366ddf1ec42224c6c4
MD5 2f9a593f31c4572733bc2f991b2b1c86
SHA1 3b47171d5daa4810b0f438b76c4c1b00d48ffff6
SHA512 5f6003c6849ebfe3a7a1d9a40d8406c3131de3134990bb931dae70668213519b7504a79789cbd9b9b3182212b965b5f74398097c8cd861dd33182f9c01f04d64
TLSH
T1C5C0120256858E5E4A045D0A19A966CCF09A099D29497FA04602885C13D3C58B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

XNaaTBgZ1E2t.bat

Path C:\Users\Admin\AppData\Local\Temp\XNaaTBgZ1E2t.bat
Size 185B
SHA256 4471b1a76aff9eb556115f6110c5c5a545866a3c29b022ddd9a39ed2075f5a93
MD5 aea4c5c08152116c718da127e1e06cd8
SHA1 7185602a018d7464dd62398015c7faf521269b3f
SHA512 cffce5a2a0050414019cb891068ee99d480cf4e74a83ed1763a11038aeb849a43685aeff8817a8f79ac8d85986a36be857e984057a03327fd8be313e70285f81
TLSH
T193C012015581CE5E46045C1A1DA9668CF096099969497FA04641CC5D17D3C58B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

XSQ7LyPjLN2l.bat

Path C:\Users\Admin\AppData\Local\Temp\XSQ7LyPjLN2l.bat
Size 185B
SHA256 956c5d97ed22877bcb47646e106f6f3ded221e6d2d6721594768c6b24d449448
MD5 78b0b357edee53ae8542685e63f81d69
SHA1 76cca478f078852927a25e6ae3413fa0f6519521
SHA512 dbd2e622bbe77da29e39311c6f65b0876bb84e15f7646916ad6278ba785951e7ab4571c5741ef4d4f9d7fda12dffc3a4abfa9c2abc90db3c32d7fd8d68dcc02c
TLSH
T106C0120155818A6E45045C1A1DA9768CF1D609992D49BFA08611885C67D3C9DF9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

YIIx8Coebz8C.bat

Path C:\Users\Admin\AppData\Local\Temp\YIIx8Coebz8C.bat
Size 185B
SHA256 57eb0170adaa06add0fcc8a948da9918f07f2443b961bc5242fad62ece83331f
MD5 dfdc49858f8de348db6bed841943b596
SHA1 cb9e0af0e10ba2d3bbd992a07999ffea6ff0f7fc
SHA512 dc0008f4bb6b3a1b0afc907318d10d9c0b362d434a915aa8ad7d328ec322a42647311ba81428032725fb66758b81668b532120341f709fde9a44acfe9313e8c9
TLSH
T18EC0120142818A5E59145C0A19EAA68CF099089D2E49BFA04541889C23D3C58B9DB792
MD5 SHA1 SHA512 TLSH

Submit Download

YQyJDdkbdiLF.bat

Path C:\Users\Admin\AppData\Local\Temp\YQyJDdkbdiLF.bat
Size 185B
SHA256 25824fcecd61d5acd934600a98a8d5ee3756ebdbb61e5f641634d6d72f918eb1
MD5 8bba424da56c51e9294cccb17a88d560
SHA1 534e4d0514f76622b6adc96e139406cc3afae704
SHA512 9fdbd118efe9cacf56531b9909303746a2dbb0dcd9cfdbaebf4c9004b6144bf2362d56855b0636e78612b11e206811d3ab1de54db2d5710dc2585ac31eecf4ba
TLSH
T1EBC0120181818B5E46145C0A19E9668CF0A5099D2A497FA14501885D53E2C58B9DFBC2
MD5 SHA1 SHA512 TLSH

Submit Download

YYD7wjvcchei.bat

Path C:\Users\Admin\AppData\Local\Temp\YYD7wjvcchei.bat
Size 185B
SHA256 6e1f2e42f56cf1f66d43bc1b541a834027f03b1e0add30921ec53f6d03e09073
MD5 52c2f814fcff0cc065ae1cf4849b5394
SHA1 5c26d20145397ed54d576a13bba2e895c5be4513
SHA512 69983663ee5b7e30402aa1bffedf6fe77e08497243c94893384f91f5e5565080dd157b82d9ea428be67419b2a058c6b47d0d85d16ed4854920dc5b930bc18d4b
TLSH
T153C0120142918A5E55046C1B5AB9668CF1DA099929497FA545018C9C53D6C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

YbrTw3hKNFoj.bat

Path C:\Users\Admin\AppData\Local\Temp\YbrTw3hKNFoj.bat
Size 185B
SHA256 10a27e33f1a129a2e1a815fe51958a7468a485ed18de5187fd0eb3d4ce3eee40
MD5 fd9f1e4a00395184155a889863f4f188
SHA1 b2c92a223e07de1bce99a16e38cdad6aeb6947c5
SHA512 3a6bd2f2c59f9d221cdad159e814075ef806895361fe8e231e808202a106f1c51b1b475b7595208989c0d5ea7cc5cdda4c96035a58c850edc6d6908ad7394c1e
TLSH
T1F9C0120142818A5F45145C0A19E9678CF0A909A929497FA04A418C5C13E2C58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

Z9H2FWMBc3PN.bat

Path C:\Users\Admin\AppData\Local\Temp\Z9H2FWMBc3PN.bat
Size 185B
SHA256 28f7f54a38ebf40f5624948461358d263186936d1e6a9eb5d94cea55573690c5
MD5 de3fa90fce5a455759c1014ca91d5621
SHA1 d6e72274b5a4a8a5f4fc0e2213a6556e8fca491a
SHA512 bec1f4d5fbae43019f607d4ec4fe4ac1b6d8baae3f3b220dd090d8472d4afa45f1f872a0ab575e0a006ee1fe69bbe8d2cd60d745ba5c0775d77840843038d163
TLSH
T1FDC012015291CA6E46145C0A19EA76CCF09508996A497FA04942885D17D2C58B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

ZmFI15JbnNBT.bat

Path C:\Users\Admin\AppData\Local\Temp\ZmFI15JbnNBT.bat
Size 185B
SHA256 283f8c2cea5859ba2ac03af180717e9f105550c5ff497001e2564043b08c90ca
MD5 9ef46b7a08adf98c037d72e526360898
SHA1 a910c1412f04a63033235eaae6f70b042f32669c
SHA512 d6413bc5013befff51a16fb9d60dd638a0da570a1b185cdb0b17bd1f73f7835ebe09515a4addb0c2735b89de25c4a3f63984d2011b204d51d053f9a6dd129c08
TLSH
T157C0120145818A5E45045C0A19E9B78CF0D509AD6D49BFA54A01885D13D3C58B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

c7MZWf3Bb5QU.bat

Path C:\Users\Admin\AppData\Local\Temp\c7MZWf3Bb5QU.bat
Size 185B
SHA256 ae1a0e4c1fd65f6cb47e61328a81681b46fba80a1610afabe4ec31e7a62ace40
MD5 6a2dd085d746bf5ff680b6b498b95717
SHA1 bca1f1e9cd9a38b1c94679e2f901ff9ced096364
SHA512 dc5f6f28672c3ff8812c3e27219e1264a3ec72bb722701b7a83db62df40da9a3ae0071a96af887e533d0b6441cc96262ff5864cfd057260213bde0040295f7db
TLSH
T14FC0120141818A6E55049C1B19A967CCF0A50C9D6A897FA04901885C13D2D5CBACB792
MD5 SHA1 SHA512 TLSH

Submit Download

cR0sDppnB5Ze.bat

Path C:\Users\Admin\AppData\Local\Temp\cR0sDppnB5Ze.bat
Size 185B
SHA256 3d7192e5d5e720800d28b643c54733a20872e582c7717995b3bd723f947dc745
MD5 c187acdad01cd83a2e44a4f03194ed80
SHA1 e7265d1667f72b4ecdf9cb7552164e2f7be56759
SHA512 9a4fc2cc246a0c7d6950e5dbd75a6867cea57be7859d608c07ab0e2662e04a864a4f036593f7da6eb74298b4d88f3b47cc7f7ee626679fcf508b9dc52eaf703b
TLSH
T1E8C0120182918A5E56549C0A59AAA6CCF0D5089969897FA44A11C85C13D6C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

iPX7nfaB8SAj.bat

Path C:\Users\Admin\AppData\Local\Temp\iPX7nfaB8SAj.bat
Size 185B
SHA256 e1462cfb7efda33c0fe911d53b320161d603782393020d7a3d6f125027fbf14a
MD5 56477c6cd76ab5a61952b2c27652cf21
SHA1 1929f5aab00efd7db6aa39dce59af9d22d417e68
SHA512 a26709803e505bf616f9ffa857cea4402d3f375e16649c8adc0c5eeee22e5fe43f2620c6f69dfef2838a89f5a4876b3e94fdd46127fc3bb8804ee9d8f7a49bd8
TLSH
T103C0120151828A5E55545C0A19A9A68CF1AA0C9D2949BFA14541C85C13D3CADB5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

mCTnXLbDicEj.bat

Path C:\Users\Admin\AppData\Local\Temp\mCTnXLbDicEj.bat
Size 185B
SHA256 85a4e9a3e7c21a140b91463c071a616a6dac5f6cda7ee507106d085ecd1a5fb4
MD5 bca1a01b7ef88bdc956767a787219fb5
SHA1 5afa3db53a6300a25e52b2dfe01678a458e935c3
SHA512 ea756b4a180b4e8107ed9d9b1ce80ac1e62ac8b2f1af1c17367bf105a77e7fd73622e0204d77153223b0f888b21c53753a845e00a7165c65cbe18deb4f581fff
TLSH
T196C0120141C18A6E45045C2A1DEA668CF0A909D96949BFA08641885D13D6C98B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

mSUPO72TaE7m.bat

Path C:\Users\Admin\AppData\Local\Temp\mSUPO72TaE7m.bat
Size 185B
SHA256 c9edc1b8bf7a57c9315b559b0450363b764004e5409555fe6f7232cd358a493b
MD5 abec61ba7c2c99a918d1a24419bd6103
SHA1 cc96a195ab73a296fd743c28dc1faf47ef47120e
SHA512 8241349897c95cdeb16e1a5b047f3c42ea4500337a2b113f5c3b2e2cd26e5b16d83fd0593e603f47beba40d9c3b4fcdc3d299ad7e5e8f6c99fb50a542e206bcc
TLSH
T159C022008181CA1E19001C0A58E9628CF09508986D087FA005008C4C13C2C58B5CB382
MD5 SHA1 SHA512 TLSH

Submit Download

oBRtfQU9LyC4.bat

Path C:\Users\Admin\AppData\Local\Temp\oBRtfQU9LyC4.bat
Size 185B
SHA256 c1b07a30e351be44d0a042e1f83d10b1e4889281b8a9620824a7a44ce71ae644
MD5 1fa4d430a850f859304fc4b463097ab0
SHA1 b3ee80f62ad8dcc413740ea1ef12deeb061238e2
SHA512 5826505ba46f6b0be5965e1c386f3c14e86ca23ff60f26342c4d012fd40127c047b75d02ca221f7232c51de0cb83a3da25fdc107cadab63c4bfe710499c87c50
TLSH
T175C012018191CA5E4A045C0B59A966CCF195099D2949BFE04551889C27D6C59B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

oLjOCpzwWZJt.bat

Path C:\Users\Admin\AppData\Local\Temp\oLjOCpzwWZJt.bat
Size 185B
SHA256 b741714ce31020966ef651dc57595dd71316484fcb3dfffdb548332e9198d6c7
MD5 16111cb54370fd0d6f67a9b6c973cc9f
SHA1 31ddc02c9792bb895b02a9805f65adbff45b160c
SHA512 fe25475d5c4df11097272fee756ea81dcff4b2a1bf416970fcfe770c57bb6d71dec3443c98718827f33e6acd6ec6ae047517ce035d75f0f172081a7ceaae5971
TLSH
T13BC012014185CB6E45145C0A59AA678CF095089969497FA54501CC5D53D2C68B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

oT4tXgtyO5nc.bat

Path C:\Users\Admin\AppData\Local\Temp\oT4tXgtyO5nc.bat
Size 185B
SHA256 1011db47a21cf7b2a9b9cb7aac8e31eca3d6861594882e2792c4fb4d4da9490f
MD5 051c497f52de8f175e632c39a4321f47
SHA1 d3ee3ff04675c94f32d6a0ba732bf816d43a04ce
SHA512 bef7f62dc46f757dad8e842b773da774fb80c1591089b2458fe296fc71257f6f21cb8674820bf51a95478dc6122d2cdb55a1c9961953210cb25cda41a192d3a9
TLSH
T129C012014692CA5E49085C0A19A966CCF0A508A96A49BFA04545885D53D6C68B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

pQDzajOSPBJj.bat

Path C:\Users\Admin\AppData\Local\Temp\pQDzajOSPBJj.bat
Size 185B
SHA256 94b08831036dd8b470d2478d6fd05283b18a4124a09dea3a4852862c8f7c652f
MD5 e17634298200d764c99c6a3b2e08668e
SHA1 0e11a78cf09da97a11aee0311e5e3516bc2da07a
SHA512 4a4dc22476b811e9f9aa7323593a110641ee6e928004c0c7f517ad1fc3f9989bf60325a6cc9a80c82938437f20c5d45beae80909b92066ee180a48c1042b2095
TLSH
T1DBC012018185CA6E45045C0A19E9678CF09509A92E497FB14541889D13D2C5CB9DFBC2
MD5 SHA1 SHA512 TLSH

Submit Download

q8XzaqZS8T3Q.bat

Path C:\Users\Admin\AppData\Local\Temp\q8XzaqZS8T3Q.bat
Size 185B
SHA256 46e5308be20c0caea648052ce1a3c9ee7f608814bc02b994653f98e85feee53b
MD5 6eee50769dfe00c141cce1a03dd40bcc
SHA1 dd597da29225c5c289af45fbbd6ec3e8fb9657cf
SHA512 8471831dcc22291aaa7a7cd602f1f879b7ae2d6dec7d3375c8edde3e96a708e892e6f6158fe7e29a0729f259afb7ea14827b263307aeb5059f13cf9535ce95a3
TLSH
T1E2C0120145868A5E55045C0A19A9AA8DF09508AD2D49BFA04601889D13D2C68B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

r5bv3McpKnHW.bat

Path C:\Users\Admin\AppData\Local\Temp\r5bv3McpKnHW.bat
Size 185B
SHA256 a875554b562a402a7c8385a1ec2cce086a8b8979589623de73d9793fccc6a571
MD5 35a80af44b74579aa76a1d73ee673932
SHA1 db6bd0a2adbc64b001ef54275d0752953727d074
SHA512 aea39276732bfa39c25601b3790ecc23741a6735e62bc757d1795720cb4aa1eef00b12cc68b5a8468eb3a075a67a57796217c3e2b26b797e8cb570330c17d43e
TLSH
T188C0120182828A5E4A045C1E1DE9768CF099089929497FA04A41C85C13D2CACB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

sUBen0GncYLF.bat

Path C:\Users\Admin\AppData\Local\Temp\sUBen0GncYLF.bat
Size 185B
SHA256 2df32dc78f551d1a4f97f4f8bfeea11c8b0843ade2331ee7384914f6c386cb66
MD5 e9495216d9ae1691886c793472463ee0
SHA1 7ead7d4c277faf1064b9878f3381d0262cdc8432
SHA512 d44c99b30a504c20d09aaf2b1c0144e12cf7ae86c94160ebe985b537e3cccc93eb755b0104694926de69f602cba89eecf7e4979eed51e8878d569c5f3019d67e
TLSH
T12FC012014191CA6E49045C1A19E9768CF09608992E4A7FA44511885C23D2C5CB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

tjykLNraQwKu.bat

Path C:\Users\Admin\AppData\Local\Temp\tjykLNraQwKu.bat
Size 185B
SHA256 a6af3d58afc68e220f43fdd7cc85615367d09b2ded019ad00618e3af352650aa
MD5 b6670962b483063ef523edc28a1c752c
SHA1 8a43c75232f120f2ea417f9e95f4698995edce83
SHA512 bb3bfcc877dc2147b1022f761a659aebf95f227072f5383d7ab4b91dda7eb7abdceef9a40cae6f619f68563f3fd26da534bb383fa1fa5598ef21810b3727221b
TLSH
T1F6C012014181CA5E59045C0A19E9768CF199089929497FA44641885C27E2C5CB5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

uYkkuJrRsCsd.bat

Path C:\Users\Admin\AppData\Local\Temp\uYkkuJrRsCsd.bat
Size 185B
SHA256 697ada81ca46fd73dfb44c00a9f9c1236b3711c2c6ac47b0a7e0efe03d86fb8c
MD5 7122de291003c48d05952b2a1b5ddd3a
SHA1 071ae7d417efd6b1ee46b3cf4341deeebbb79be4
SHA512 9eadcb64e962c7e55b97c0a605b841f1f0241877b0407832ec9f8f1881b061340557d9c151c5348083ffb05b0bfd4aabc842d707c7b91c49b25a58244ec76d33
TLSH
T101C0120146818A5E4A045C1E19A9678CF0D50C9969497FA446018C9C53DAC58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

veCCR7CzX7lS.bat

Path C:\Users\Admin\AppData\Local\Temp\veCCR7CzX7lS.bat
Size 185B
SHA256 19de462bf0880e3ed85508e28237260f073baaf40d35c8bef8c161b00547f689
MD5 fd670ace71f6d50d533e2ec097878808
SHA1 749561b2691d02d432e307c0096f5042ed0ac134
SHA512 04dc85962fcb1472a315901b455f007e45ae3deb11bde56a58b34bd65d0c0be56d75d5385767aaf2c4d31fa865bfe349476150e740856928c52babc9c9eaad6b
TLSH
T150C0121182918A5E45045C1A19AA668CF0A508992E49BFA08501885D17D3C5CB9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

wNB5k3SvPV2l.bat

Path C:\Users\Admin\AppData\Local\Temp\wNB5k3SvPV2l.bat
Size 185B
SHA256 71df556767ae8fa4e11f7a6c7ab3cb3e5d64a7ef79a08eb6f56588ad999cdad6
MD5 d84a2aef24861798977c3dbccba50240
SHA1 5061b3d0dc2aea6562253de29d0c740d76bd25ef
SHA512 31d5acaa031cc95afa1011a0d388944dcd288f3a8d4692b78e0912a29ccc165e8e73438f1f9aa5218ef65bc5ae48209cfc3751349e78ed4ea3335a39a6b48c04
TLSH
T157C012014281CA6E49445C0A19EAA68CF095089929497FA04541889C27D2C58B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

yP5OUlfnossE.bat

Path C:\Users\Admin\AppData\Local\Temp\yP5OUlfnossE.bat
Size 185B
SHA256 8e362b8b36de9bec5c7c03dfcfcdc5faa32e1d5a06c1479ae4af1de6cc59bc95
MD5 68f24ff5dcfee3525ebd9b43c19ffa07
SHA1 701e1a09639dc95d84ef227fb85bc72374180a51
SHA512 fb67b94d81133d7c228e3dce36fe2585bedbaabc3186c55c58cc09c2a7ae58e96bd970d76b26c2824ed7fe5f9a1e2bb077ebd09919fa4acc03fc4b9df66b3eb3
TLSH
T121C012014185CA5E46149C0A19EA678CF099089939497FB04A11889D13D3C5DB9CFB92
MD5 SHA1 SHA512 TLSH

Submit Download

yru4bb0JLSHP.bat

Path C:\Users\Admin\AppData\Local\Temp\yru4bb0JLSHP.bat
Size 185B
SHA256 b5bf8b1b4c97eca4eb144de23b0d990c2cc700d8a103b3dc1a3e02e1430a6ef5
MD5 e678aea3c661f7d7e080ea7397564bb3
SHA1 3bc782cf39a578211ec22779dcfd94366a5c1cfa
SHA512 d076714f4d08468486dde76cd6bbb448a1256448542bdd94643ee99cc963c2b91d04a7f0c89e323979856142c3f8d8dd5a7eebf6cddb7868ee2dcbbbedd5e5c5
TLSH
T14BC0120151928A6E45045C0A19EA678CF0990CAD29497FA14601889C23D2C68B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

ziaNedliAcgy.bat

Path C:\Users\Admin\AppData\Local\Temp\ziaNedliAcgy.bat
Size 185B
SHA256 458fdad9a077ac00067192eb1ccd7b27f61cb1d27e92d3caf518777e79e92a1f
MD5 f6eac058c7d92d40d55cbc41aa919472
SHA1 4ea77bcb9aa7d25e988ce0ba13e83667b0565481
SHA512 e9184c364e3d5b6f013588fea9e1ad46f2a2177d3fe4cbf1ea3dcd78bf7665841b09d469068f7f69d957679a128bce7e56c21a3a823f6c23fbc47cd3ba90f11d
TLSH
T19FC0120145928A5E56446C0A19E9668CF095089E29497FA48501889D63D7C68B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-123-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Download

memory/244-122-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Download

memory/400-176-0x00000000031F0000-0x00000000031FC000-memory.dmp

Download

memory/400-177-0x0000000003320000-0x0000000003332000-memory.dmp

Download

memory/904-44-0x000000001BB50000-0x000000001BB5C000-memory.dmp

Download

memory/904-45-0x000000001BB60000-0x000000001BB72000-memory.dmp

Download

memory/1164-21-0x00000000017C0000-0x00000000017D2000-memory.dmp

Download

memory/1164-20-0x00000000017B0000-0x00000000017BC000-memory.dmp

Download

memory/1484-141-0x0000000001280000-0x0000000001292000-memory.dmp

Download

memory/1484-140-0x0000000001270000-0x000000000127C000-memory.dmp

Download

memory/1492-129-0x0000000001800000-0x0000000001812000-memory.dmp

Download

memory/1492-128-0x00000000017F0000-0x00000000017FC000-memory.dmp

Download

memory/1640-56-0x0000000003120000-0x000000000312C000-memory.dmp

Download

memory/1640-57-0x0000000003130000-0x0000000003142000-memory.dmp

Download

memory/1716-111-0x00000000032B0000-0x00000000032C2000-memory.dmp

Download

memory/1716-110-0x00000000032A0000-0x00000000032AC000-memory.dmp

Download

memory/2020-195-0x0000000001240000-0x0000000001252000-memory.dmp

Download

memory/2020-194-0x0000000001230000-0x000000000123C000-memory.dmp

Download

memory/2036-170-0x0000000001820000-0x000000000182C000-memory.dmp

Download

memory/2036-171-0x0000000001A40000-0x0000000001A52000-memory.dmp

Download

memory/2552-26-0x0000000003360000-0x000000000336C000-memory.dmp

Download

memory/2552-27-0x0000000003370000-0x0000000003382000-memory.dmp

Download

memory/2604-135-0x0000000001720000-0x0000000001732000-memory.dmp

Download

memory/2604-134-0x0000000001710000-0x000000000171C000-memory.dmp

Download

memory/2776-105-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Download

memory/2776-104-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Download

memory/2884-74-0x00000000025C0000-0x00000000025CC000-memory.dmp

Download

memory/2884-75-0x00000000025D0000-0x00000000025E2000-memory.dmp

Download

memory/3012-158-0x0000000002ED0000-0x0000000002EDC000-memory.dmp

Download

memory/3012-159-0x000000001B7C0000-0x000000001B7D2000-memory.dmp

Download

memory/3068-183-0x0000000002B40000-0x0000000002B52000-memory.dmp

Download

memory/3068-182-0x0000000002B30000-0x0000000002B3C000-memory.dmp

Download

memory/3080-38-0x0000000002D40000-0x0000000002D4C000-memory.dmp

Download

memory/3080-39-0x0000000002D50000-0x0000000002D62000-memory.dmp

Download

memory/3144-153-0x00000000014A0000-0x00000000014B2000-memory.dmp

Download

memory/3144-152-0x0000000001490000-0x000000000149C000-memory.dmp

Download

memory/3488-51-0x0000000001530000-0x0000000001542000-memory.dmp

Download

memory/3488-50-0x0000000001520000-0x000000000152C000-memory.dmp

Download

memory/3500-92-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Download

memory/3500-93-0x0000000000D00000-0x0000000000D12000-memory.dmp

Download

memory/3668-188-0x0000000002BF0000-0x0000000002BFC000-memory.dmp

Download

memory/3668-189-0x0000000002C00000-0x0000000002C12000-memory.dmp

Download

memory/3744-116-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Download

memory/3744-117-0x0000000000CC0000-0x0000000000CD2000-memory.dmp

Download

memory/3964-0-0x0000000000F60000-0x000000000128C000-memory.dmp

Download

memory/3964-6-0x0000000003360000-0x000000000336C000-memory.dmp

Download

memory/3964-7-0x0000000003370000-0x0000000003382000-memory.dmp

Download

memory/3964-1-0x000000001BEB0000-0x000000001BEC0000-memory.dmp

Download

memory/4020-164-0x0000000003370000-0x000000000337C000-memory.dmp

Download

memory/4020-165-0x00000000034A0000-0x00000000034B2000-memory.dmp

Download

memory/4132-63-0x0000000000D50000-0x0000000000D62000-memory.dmp

Download

memory/4132-62-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

memory/4244-68-0x00000000025D0000-0x00000000025DC000-memory.dmp

Download

memory/4244-69-0x00000000025E0000-0x00000000025F2000-memory.dmp

Download

memory/4288-10-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/4288-14-0x0000000002F20000-0x0000000002F2C000-memory.dmp

Download

memory/4288-15-0x0000000002F30000-0x0000000002F42000-memory.dmp

Download

memory/4356-86-0x00000000017E0000-0x00000000017EC000-memory.dmp

Download

memory/4356-87-0x0000000001820000-0x0000000001832000-memory.dmp

Download

memory/4432-80-0x00000000010E0000-0x00000000010EC000-memory.dmp

Download

memory/4432-81-0x0000000002AD0000-0x0000000002AE2000-memory.dmp

Download

memory/4608-33-0x00000000014E0000-0x00000000014F2000-memory.dmp

Download

memory/4608-32-0x00000000014C0000-0x00000000014CC000-memory.dmp

Download

memory/4892-147-0x0000000002FF0000-0x0000000003002000-memory.dmp

Download

memory/4892-146-0x0000000002FE0000-0x0000000002FEC000-memory.dmp

Download

memory/5004-99-0x00000000018D0000-0x00000000018E2000-memory.dmp

Download

memory/5004-98-0x00000000017A0000-0x00000000017AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads