Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/07/2026, 01:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260709-bpdfxsbs8n
  • SHA256 c3ad75fd4f8b3d8105eb1403396506111d1ff4ee2cc51f3d7a257128d2c53860
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • xoilac365ll.cc

  • malware.xoilac365ll.cc

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qobRDNaBAM9r.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3556
        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3092
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWzWx7lc3guI.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5060
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:3856
              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                5⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3876
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s1bl0DcyL89s.bat" "
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4668
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    7⤵
                      PID:4460
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      7⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3204
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aVsKiAq74Jbb.bat" "
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1772
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          9⤵
                            PID:4952
                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                            9⤵
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2160
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oaTp7fuX2k3g.bat" "
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4592
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                11⤵
                                  PID:2200
                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                  11⤵
                                  • Checks computer location settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1800
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gw0j8ejFhnrd.bat" "
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4292
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      13⤵
                                        PID:4860
                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                        13⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:4992
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nR1tgxXXiVyx.bat" "
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5020
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            15⤵
                                              PID:884
                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                              15⤵
                                              • Checks computer location settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4180
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAlaunF31z9B.bat" "
                                                16⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:2436
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  17⤵
                                                    PID:3712
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    17⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2476
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y55ROaM72W9g.bat" "
                                                      18⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1784
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        19⤵
                                                          PID:1908
                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                          19⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3504
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ns42EzYpqcFg.bat" "
                                                            20⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1756
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              21⤵
                                                                PID:1192
                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1708
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jbu6BmKg6cKd.bat" "
                                                                  22⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4312
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    23⤵
                                                                      PID:564
                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                      23⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2252
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkLhtP8bszFf.bat" "
                                                                        24⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2156
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp 65001
                                                                          25⤵
                                                                            PID:2176
                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                            25⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2328
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKvrBVYIf496.bat" "
                                                                              26⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1464
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                27⤵
                                                                                  PID:4080
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  27⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3916
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GcPVR3DxoDh3.bat" "
                                                                                    28⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:116
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      chcp 65001
                                                                                      29⤵
                                                                                        PID:3980
                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                        29⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2404
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\013X8EHvVqRv.bat" "
                                                                                          30⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:692
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            31⤵
                                                                                              PID:4452
                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                              31⤵
                                                                                              • Checks computer location settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4728
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P80tzXV9SWpP.bat" "
                                                                                                32⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4196
                                                                                                • C:\Windows\system32\chcp.com
                                                                                                  chcp 65001
                                                                                                  33⤵
                                                                                                    PID:4884
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                    33⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4596
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VvXC9WDonWah.bat" "
                                                                                                      34⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2604
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        35⤵
                                                                                                          PID:1192
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                          35⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2824
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A9yo6bVgBM6y.bat" "
                                                                                                            36⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1256
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              37⤵
                                                                                                                PID:2828
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                37⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1148
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEv7t7LvMxij.bat" "
                                                                                                                  38⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1044
                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                    chcp 65001
                                                                                                                    39⤵
                                                                                                                      PID:1624
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                      39⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3188
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pAHV7vp6JE69.bat" "
                                                                                                                        40⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4468
                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                          chcp 65001
                                                                                                                          41⤵
                                                                                                                            PID:3816
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                            41⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1236
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tQ2zDGCSd8zt.bat" "
                                                                                                                              42⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1028
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                43⤵
                                                                                                                                  PID:1196
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                  43⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:2880
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DyVxBIJoyNM9.bat" "
                                                                                                                                    44⤵
                                                                                                                                      PID:2024
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        45⤵
                                                                                                                                          PID:396
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                          45⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3004
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UsgKbVQqWJv6.bat" "
                                                                                                                                            46⤵
                                                                                                                                              PID:2940
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                47⤵
                                                                                                                                                  PID:4340
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                  47⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3748
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HAUMi1IdfjwF.bat" "
                                                                                                                                                    48⤵
                                                                                                                                                      PID:1180
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        49⤵
                                                                                                                                                          PID:4836
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                          49⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:3500
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGVwUo1WIuyj.bat" "
                                                                                                                                                            50⤵
                                                                                                                                                              PID:1808
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                51⤵
                                                                                                                                                                  PID:2816
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  51⤵
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:1320
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UlBFUzaqTaqu.bat" "
                                                                                                                                                                    52⤵
                                                                                                                                                                      PID:4684
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        53⤵
                                                                                                                                                                          PID:4064
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                          53⤵
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3600
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ME4YzvpaKII4.bat" "
                                                                                                                                                                            54⤵
                                                                                                                                                                              PID:2908
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                55⤵
                                                                                                                                                                                  PID:2616
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                  55⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:3816
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pcBbTktRnMIt.bat" "
                                                                                                                                                                                    56⤵
                                                                                                                                                                                      PID:4388
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        57⤵
                                                                                                                                                                                          PID:748
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                          57⤵
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:2200
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f3jR5fdjjLsh.bat" "
                                                                                                                                                                                            58⤵
                                                                                                                                                                                              PID:3904
                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                59⤵
                                                                                                                                                                                                  PID:208
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akFaej7sD5Y8.bat" "
                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:3716
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MZWvinr3fBtH.bat" "
                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SYjdIJN8Xb6c.bat" "
                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:2116
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\REtBwIIgWZpp.bat" "
                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                              PID:2816
                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pg8L0Z8qYt5W.bat" "
                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                      PID:1200
                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HePRYYYIUl4j.bat" "
                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                  PID:776
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TbNCnrNRAFiq.bat" "
                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                      PID:3408
                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OExZztKmnoWu.bat" "
                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                              PID:1468
                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M3oUiIfrVaXH.bat" "
                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:3896
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGiwpkJQpkmW.bat" "
                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vdPnLxF15mq2.bat" "
                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIhrLYbFiF4M.bat" "
                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                  PID:2344
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l20qPd4NqGdI.bat" "
                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:3852
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uWZsMt4fecNA.bat" "
                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                  PID:1212
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hAk8bFhl4KdL.bat" "
                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                      PID:1012
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lJBOjmd07mxV.bat" "
                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:3116
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OH74GgIv9v3g.bat" "
                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OYEr5XVdvutC.bat" "
                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YeOv5fK3JcQL.bat" "
                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:3744
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XfGFZnQD7d3I.bat" "
                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:216
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2oHmQ7BEfLZs.bat" "
                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1008
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cxgutsVqQPDq.bat" "
                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cEzA9GbApqRS.bat" "
                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\23WseXN5fOgY.bat" "
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1192
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mnbb10d60czY.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4064
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\402NykI2AS6B.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9c7fFYianapi.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q8Dksq1Jpm1t.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HATeCn53pYkW.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYFq4aSL8RB2.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bhRTrlRNb1ax.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x5yrTqIpckCB.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eAPuP0SRnHC5.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p6ZyFSlZhS4Z.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gWITKrBLcYme.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\docDXpX078Di.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kYkDcvtqONWU.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ShvSbg1YFtjr.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IwDtV7EeoJsG.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yI3HNDa5YnCb.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GJNqRWDKlLAJ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JY5KZGKCt9Od.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4ozRGeF6IcDh.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bnYuUVW4Y6eD.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eP0LsDKU3lWS.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cerLFZJ9hOWp.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGzBFdod3ctU.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ywOXdNUvUbmv.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MgOWF1BToBXh.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vYq8w5JWaCpH.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NyPXgw9Sgav6.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CvVgTMrAMTs0.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQuZgIJfEK9S.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\818le4FThJlK.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmhOtdqANdbO.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIWoX9rVbJyq.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SOPKDFD5XWui.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rkwuwrvBGcs7.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GSDBu8b5cc8U.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TZWRkouLwn18.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4Lgi9Solxlsa.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r7S4tAFsfWzf.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SnC8DWFSS290.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9zgjTHyZIwf1.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6tQRs8jqyJIG.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\REGWjHQHY8FJ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FEahrYeuK237.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZT6Msl92Hma2.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Bvl1H41iNUOX.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYXb3S7b4dR8.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RqbWWWcY4CgV.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KJb5Pu0iz7Hn.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dHaJEBkkjhwp.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UqSkfrMgrbeo.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f9CLGRHFrvWo.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4428

                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                    messenger_update.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    013X8EHvVqRv.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\013X8EHvVqRv.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 183d364aa52bcdd2eadd96bc06307089d9d93a40396ba3354867fe5785d6fe52
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    23WseXN5fOgY.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\23WseXN5fOgY.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4eea1330ad855670a3f08acf0791e66c8ec8040e2bcb2fe456b0c7adbaf9abe2
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    2oHmQ7BEfLZs.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2oHmQ7BEfLZs.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 063f3f98a977aa8ac8b2af47176decc40493298b55f6f0abb2ccc888f0fe72b0
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    402NykI2AS6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\402NykI2AS6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 583b838b21dce7eb2a4983d334d4c71411b0e14f8c6ccd45cb0e537eed0f669a
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    9c7fFYianapi.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9c7fFYianapi.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 68890347bafdc94646c20da6eadc33f116c4d999a73e31b5b397e2ce706b1862
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    A9yo6bVgBM6y.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\A9yo6bVgBM6y.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 727209d097bc1d902316c9bc8634119709b921d8423fca756aa6582892a531fd
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    CGVwUo1WIuyj.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CGVwUo1WIuyj.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 cfde55eabab8ae2c8036fd35e0de994bcae768597a16efaaac594f41817455e4
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    DyVxBIJoyNM9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\DyVxBIJoyNM9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4a04c7f140293486a64d3cc41b5814ce034b1096bca6a9a51bcf4217eb3f1d59
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    GcPVR3DxoDh3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GcPVR3DxoDh3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4addaf5bba4b3f2fe3c75a487fc6f66be1d7199d6e1f30de1fcad1f6a4daed7a
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    Gw0j8ejFhnrd.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Gw0j8ejFhnrd.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9abb907c3972b5d9d2deebe29013ea3238fb9566718285ee538106fff75de139
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    HATeCn53pYkW.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HATeCn53pYkW.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a910c57d0aebcdf816dbe57c21ee9da7516fa5d0df665744f089bd059dd98bf7
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    HAUMi1IdfjwF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HAUMi1IdfjwF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 359c06c423c26958ee606400967e38cdb71e3f3c7d69dd3f8f0615920886257d
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    HKvrBVYIf496.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HKvrBVYIf496.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 77ae70fad64083eec11ea94b9c39606eca8ec82798de2abd3cbf5b95819e64d5
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    HePRYYYIUl4j.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HePRYYYIUl4j.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f2f0f81fcf81f78999f5aca5ab7113fac2bb36eb01a5731b4794014d75365ec7
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    Jbu6BmKg6cKd.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Jbu6BmKg6cKd.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2b449b5b8ae9334a51da2b87e712017e1e28f23fe1ee88243e7812961af5d07c
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    M3oUiIfrVaXH.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\M3oUiIfrVaXH.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 90df48419eceaa7af85ba74febe002a353256ad22085f53825694bd9d620ef1a
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    ME4YzvpaKII4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ME4YzvpaKII4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 21e579a6941c0706eac140162f38872de803471418d053b3bb6c5369f5a534e6
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    MZWvinr3fBtH.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MZWvinr3fBtH.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a1c1f417d6a70cbfc13716510dd19f56e1e5dad9f2f22090a20ba7adf24c8b1f
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    Ns42EzYpqcFg.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ns42EzYpqcFg.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6cd3adde36577d657c788ea0f0f0ba8788fe96a3977a283cd659c68e365f1b5e
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    OExZztKmnoWu.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OExZztKmnoWu.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4d75b4da39b735a73e54a4b68e24fc145e6801ea51ed20571d31ca750790f219
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    OH74GgIv9v3g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OH74GgIv9v3g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9116067f664e7050633e89c655b408c41e4a27ce4b2a4e5639180c92d797f8dd
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    OYEr5XVdvutC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OYEr5XVdvutC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 95c709526ee5cadb40454478008e6db91be80b08516cff0d00b00c61ca9e3135
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    P80tzXV9SWpP.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\P80tzXV9SWpP.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 34ca80f0c2ffa40ce4abc1c255e041055869f12d5d57a907bff90a8572a3d97e
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    Pg8L0Z8qYt5W.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Pg8L0Z8qYt5W.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 534aa5d4b43c74c92c68940b256149ea110137ba920c13b501dd7d907dab7efd
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    QkLhtP8bszFf.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QkLhtP8bszFf.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 21d18ee76b621919eea8e04b6cf4bbecdfb449577bb9cc017361b1dc259fa9d7
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    REtBwIIgWZpp.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\REtBwIIgWZpp.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4f026fa834daf143db1b6083fc1494dec1f5e6eac54a606845f5726627292241
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    SYjdIJN8Xb6c.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SYjdIJN8Xb6c.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 20b94e585e6a45d8d7342fbc6b2ade1cffda0e756347fffd6fe13a448daf34fa
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    TWzWx7lc3guI.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\TWzWx7lc3guI.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 46238b5e8226e96dad1f4e71a951e7c97f33db17e38c781ff86cb5e7baa58f9b
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    TbNCnrNRAFiq.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\TbNCnrNRAFiq.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7a6fe6d86cea2403da9880ecf512207ef825c8d6efba5c1037dba2caad25dcec
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    UlBFUzaqTaqu.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UlBFUzaqTaqu.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6b1b64fa9dc00b7c8bb8a793038ac75c6d5b4038000d958f09e8126b8fa5c648
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    UsgKbVQqWJv6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UsgKbVQqWJv6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5d284474a7368442284933ade37a5351e4d8bec405a5ce531b29a16597434315
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    VvXC9WDonWah.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\VvXC9WDonWah.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 18bbfedeb46bf7c6ad311064e032839c94db159b773b86230e8d0617edc496c4
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    XfGFZnQD7d3I.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\XfGFZnQD7d3I.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7b88c4996dd0867aae347e0994a4bf6c2f324521cd78b89f1c8141f57361094b
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    Y55ROaM72W9g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Y55ROaM72W9g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3695962facac2b58e631c5130ccb5f0f02fbe3f523a05c92ca94b6e559206722
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    YeOv5fK3JcQL.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YeOv5fK3JcQL.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2e1b96a100da311ce23044610b12167ab2b2c53a0c1214c411cf666b81d9ac82
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    aGiwpkJQpkmW.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aGiwpkJQpkmW.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 70c2184e8140fa76fe208553c7ade8506ebf2a1544918bb90e7daf9520ed6810
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    aVsKiAq74Jbb.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aVsKiAq74Jbb.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 900017a179049b36951bd6899d7a3a29a1d1423642c7ca8ddad18ecc4f95fc10
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    akFaej7sD5Y8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\akFaej7sD5Y8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7b62aa05c57b819e8f9d153b0f76a5333af83ba9be8925dbd0d2ff966fdccbc8
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    bhRTrlRNb1ax.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\bhRTrlRNb1ax.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 218febfee5ccdec6eaa44c5d23d5363c2da1718972b38691979a56bc6b365246
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    cEzA9GbApqRS.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cEzA9GbApqRS.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c0954e14d28df31436d86dc16a6155bc08ab1ef27ecac2473ec217a5e63559ec
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    cxgutsVqQPDq.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cxgutsVqQPDq.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f45d5b323e5e02366d0116f4eeed6482b4ae6ca49d6d4262542e95d8cbc54f6c
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    eAPuP0SRnHC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eAPuP0SRnHC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6be61e12c2eb4f084d3e65f2439d95096df06aa5c43918504d67aa9138f7e42e
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    f3jR5fdjjLsh.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\f3jR5fdjjLsh.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e95ea41d6bb2977d30c24ff9be252540c89c59e3c842660ff8303daea393219c
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    hAk8bFhl4KdL.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\hAk8bFhl4KdL.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c287d88cf56a3c69869eeacf41191a103d8e70cc30d7309a6797dc1ee1e17aca
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    l20qPd4NqGdI.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\l20qPd4NqGdI.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2b292c421b8085f47e94593d0d4a766413f2f006d1268a7958d8d1e13f8c14e8
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    lJBOjmd07mxV.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\lJBOjmd07mxV.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ab1ddfd428f8b072031f6c7b5632fb20da88c6f5383b77ab20109fead887cf77
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    mnbb10d60czY.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mnbb10d60czY.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1b066ab2f9b776bf659db9e8600a6dc68152d499324f0009e30f153475582cfe
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    nAlaunF31z9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nAlaunF31z9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 60912f72e4b3b1906c0c711c463d67a607c9d9f0611e293a7ac287aa95c6c569
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    nR1tgxXXiVyx.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nR1tgxXXiVyx.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5e5d286dd6a19ddbf5e63898c509a27d056d02461c9e8509378b4d0fc31aeb82
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    nYFq4aSL8RB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nYFq4aSL8RB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 49e8eb86e40ff1d39198ab6f3fbdae964b2f314413a33a1c93885947ec762150
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    oaTp7fuX2k3g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oaTp7fuX2k3g.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e18d4a07b82e945a66053d11f083c217b91f03f05b3a8c9e14e1fc8c42f7855e
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    p6ZyFSlZhS4Z.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\p6ZyFSlZhS4Z.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f7e42fcc05052cb993a1f9649c0b21f4b5cdb978682ac43f57de477b1c508765
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    pAHV7vp6JE69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\pAHV7vp6JE69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 09541ee169588eec12edc9aebf258eca353ebfe9325df1fd3ae8fb0f7c0d9988
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    pcBbTktRnMIt.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\pcBbTktRnMIt.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6f784580623652b96f02589807254ad4743d540cd96f8565dc80d06b225692a0
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    q8Dksq1Jpm1t.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\q8Dksq1Jpm1t.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 32ef04a6b44871f0da837fcd8fee9eedde2f5937eef18bea622004ac64a0ad08
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    qobRDNaBAM9r.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qobRDNaBAM9r.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 143a52c3a0c4868f6e4f22721fcadd2a9c873d356de0317f7c4dfebb45db3fa5
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    s1bl0DcyL89s.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\s1bl0DcyL89s.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 92031df203f1b688a243f50fa958970827f52d469cb602adba83267d45b8d92f
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    tEv7t7LvMxij.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tEv7t7LvMxij.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 11fcce2dc75ed30fdd7b49fa353fe6e4554d63fc97c4e944140dfaa51cfd461f
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    tQ2zDGCSd8zt.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tQ2zDGCSd8zt.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7efc9298edfa0e6876cc6fbe889908061180a4c145e9d4482ea6b3e1bae12c35
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    uWZsMt4fecNA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uWZsMt4fecNA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2fcebb00640e9f1cb6db302bd14235c9c97594430ad6841633470c45dbad9eb5
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    vdPnLxF15mq2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\vdPnLxF15mq2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5b39f76ba7be13358ffcd3a791a295d07d8e08ce878e16e827a6727cc3cd68b4
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    x5yrTqIpckCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\x5yrTqIpckCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 be2c9b06276390dd2be2d17ccdb049869a78722f39c946f69bfc664e87dc8ea9
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    zIhrLYbFiF4M.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\zIhrLYbFiF4M.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0f2a164da4efb744d7917180f0b41dac15a1292cd51f70561212c80ae1106c5c
                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3008-0-0x0000000000480000-0x00000000007AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3008-1-0x000000001C6A0000-0x000000001C6B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3092-8-0x000000001B490000-0x000000001B4A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                    Download