Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/07/2026, 03:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260711-dspdpsaz8k
  • SHA256 1c3e3c3c2ed22a2afbd57f886872c9e1f1530764c5ad073c5a46a5b502662e84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • saasi.io

  • malware.saasi.io

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GRZysruWm5uw.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4008
        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3952
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iinxTo8vY1Ip.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:748
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:2476
              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                5⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2656
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m9FbY9FszunV.bat" "
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:760
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    7⤵
                      PID:5032
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      7⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4316
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rPs7JhlstUkk.bat" "
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4760
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          9⤵
                            PID:3816
                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                            9⤵
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4888
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pHhDLHCCp3P7.bat" "
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5012
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                11⤵
                                  PID:316
                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                  11⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1516
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2qi43GwsqffQ.bat" "
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3732
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      13⤵
                                        PID:3344
                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                        13⤵
                                        • Checks computer location settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2652
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5H2Dncp5pKNO.bat" "
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4336
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            15⤵
                                              PID:3384
                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                              15⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:868
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uvSMUV19D3ZL.bat" "
                                                16⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:3740
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  17⤵
                                                    PID:3776
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    17⤵
                                                    • Checks computer location settings
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1120
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0qnlOqAhIBlS.bat" "
                                                      18⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2584
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        19⤵
                                                          PID:4956
                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                          19⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4672
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bczaWuvKPNDt.bat" "
                                                            20⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4464
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              21⤵
                                                                PID:4188
                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                21⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3672
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3qKnJsAILHgT.bat" "
                                                                  22⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4260
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    23⤵
                                                                      PID:4820
                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                      23⤵
                                                                      • Checks computer location settings
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:668
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KNRdBuaaml4o.bat" "
                                                                        24⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4008
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp 65001
                                                                          25⤵
                                                                            PID:3452
                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                            25⤵
                                                                            • Checks computer location settings
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4792
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LkOv8ywQcRjH.bat" "
                                                                              26⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3600
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                27⤵
                                                                                  PID:2644
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  27⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4632
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FbXlWGb6FVMg.bat" "
                                                                                    28⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4048
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      chcp 65001
                                                                                      29⤵
                                                                                        PID:2476
                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                        29⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3656
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZRStSA6qOwl1.bat" "
                                                                                          30⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:464
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            31⤵
                                                                                              PID:1984
                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                              31⤵
                                                                                              • Checks computer location settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4528
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yLZrAPs1GXA3.bat" "
                                                                                                32⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3796
                                                                                                • C:\Windows\system32\chcp.com
                                                                                                  chcp 65001
                                                                                                  33⤵
                                                                                                    PID:1112
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                    33⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3828
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQ4Fl2hMzjv7.bat" "
                                                                                                      34⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3816
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        35⤵
                                                                                                          PID:512
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                          35⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3360
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q002PMpBXb9O.bat" "
                                                                                                            36⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2580
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              37⤵
                                                                                                                PID:5056
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                37⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4572
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Um5wc6HCjxzo.bat" "
                                                                                                                  38⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4480
                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                    chcp 65001
                                                                                                                    39⤵
                                                                                                                      PID:4472
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                      39⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:680
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1iJV5O2gPc4J.bat" "
                                                                                                                        40⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4332
                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                          chcp 65001
                                                                                                                          41⤵
                                                                                                                            PID:2084
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                            41⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2228
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VlRKUynQT7B0.bat" "
                                                                                                                              42⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:4112
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                43⤵
                                                                                                                                  PID:4440
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                  43⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:624
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6hZTC8mYCLMp.bat" "
                                                                                                                                    44⤵
                                                                                                                                      PID:1844
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        45⤵
                                                                                                                                          PID:1292
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                          45⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:4028
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UgPa2spQG7zi.bat" "
                                                                                                                                            46⤵
                                                                                                                                              PID:2964
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                47⤵
                                                                                                                                                  PID:3420
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                  47⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3452
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KeZoffgCx2Em.bat" "
                                                                                                                                                    48⤵
                                                                                                                                                      PID:4908
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        49⤵
                                                                                                                                                          PID:3412
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                          49⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4932
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D8pwqThRfUCC.bat" "
                                                                                                                                                            50⤵
                                                                                                                                                              PID:1420
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                51⤵
                                                                                                                                                                  PID:1864
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  51⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:3808
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bwPnDoqg8ZTB.bat" "
                                                                                                                                                                    52⤵
                                                                                                                                                                      PID:5040
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        53⤵
                                                                                                                                                                          PID:4104
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                          53⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3532
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3b6MRMN8ThDQ.bat" "
                                                                                                                                                                            54⤵
                                                                                                                                                                              PID:1464
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                55⤵
                                                                                                                                                                                  PID:756
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                  55⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:4788
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ufRr3kk9AjYW.bat" "
                                                                                                                                                                                    56⤵
                                                                                                                                                                                      PID:2500
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        57⤵
                                                                                                                                                                                          PID:1044
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                          57⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:4156
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xayJVFW50MA3.bat" "
                                                                                                                                                                                            58⤵
                                                                                                                                                                                              PID:3488
                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                59⤵
                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z0sdIasX6t5q.bat" "
                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:820
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bzrBTndWEuTd.bat" "
                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:3228
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iE2WhUhFT2fF.bat" "
                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                          PID:2532
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3232
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GJUBqBR6FFm1.bat" "
                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0bqBn8qgRf0T.bat" "
                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:4012
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUKuMNeO5tkg.bat" "
                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H0slYLu0TgVC.bat" "
                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\68P1JmAHLP9M.bat" "
                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                              PID:1200
                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dxh92atKJR6v.bat" "
                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nhLP5qgheZqA.bat" "
                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                              PID:364
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7GuAwZmZYYP1.bat" "
                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                      PID:728
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                          PID:3920
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:1700
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dt66zDzsEhj4.bat" "
                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EBYkDkOlsHpz.bat" "
                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                          PID:996
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xGRuWS2DM5sA.bat" "
                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BrJI8W0rjpmv.bat" "
                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                      PID:756
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:1776
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\V7Yi3bRPg7CU.bat" "
                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:376
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pvPM6ZsJghd3.bat" "
                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LxxaQCisqlzv.bat" "
                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UYrM24PFqnZ9.bat" "
                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4896
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:628
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ExHdbYK95ULj.bat" "
                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\woxjUD7D714r.bat" "
                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r5zZ5SGOxqFI.bat" "
                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\K0xlquz3lBnd.bat" "
                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J3JIAp3TsRkX.bat" "
                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NMdcU2uViKi1.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQZ3Uht5NrFX.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f8X4aPn8NEht.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ImnRDBJbKbfK.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ArbroV84CL9F.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS88lLFSE4Y0.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSsYL8Sb58tc.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EVGruk5SpSbb.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hZjR9YUR2sqh.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZVFuEwX5sAbk.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AAMbjaLV6yNe.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VPgjV51bcMQF.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j6xsQTpsY4rF.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J0N7ZExgiHwS.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCq852UchmBh.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mip3wjfSbUWJ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mxsxV4FoiYQ8.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8TV7wdQwfk4Q.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\22R25vLH2Shr.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Blp7dvWKE8DR.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A9TF7wVpfHbG.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YR4y6dWg0HIU.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kszGP1Djuo8i.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eOpJe9fCe6nD.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OdMb8fMTeIb6.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeSsH2WrOEik.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZsRpDUT96Ijb.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQM7V0wWUOvU.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g2hEt9ABOsMj.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zn09I3rzT5Yj.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vK0eFKcqkv8W.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4SXdHGRvr3Kp.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j63deIdJBJzU.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P0d3QOn7CRWV.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgpuYsUDMWEr.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWBKs2Lop8vN.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Tl4ePo5u28Zi.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ky4OwxTcSkEO.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\psp3ahGfyiWR.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQqyQbKNcGLq.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\77qDStq9uzm3.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZzwlzOJzizet.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZD5bxmPV21k5.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lXAOixGySoBZ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dCqCdlLwUPqp.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:448

                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                  messenger_update.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  0bqBn8qgRf0T.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\0bqBn8qgRf0T.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2b762152afd791176615b5dc2a534e2c7d54bc487179a502076a81483ae2f0a0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  0qnlOqAhIBlS.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\0qnlOqAhIBlS.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 116ad88669f0034d4e948ca1af69b6adbf57cae3680cac00f14b473085521570
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  1iJV5O2gPc4J.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1iJV5O2gPc4J.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b6d11545674a87e5b1765cb5c4f17d2e723aabc031d171b16006b1e43f3c683a
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  2qi43GwsqffQ.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2qi43GwsqffQ.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d126f0839de698e93a13bde6686252d18d36cb0b5cf416e0258a958c7adf7ef
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  3b6MRMN8ThDQ.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\3b6MRMN8ThDQ.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 91e10606e5170500655009e475d09fa0751985b86c5995dded3f400fd04cd7ba
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  3qKnJsAILHgT.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\3qKnJsAILHgT.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 539cfef56f04c9916b450b021eaf69e92ff203eb29d09814699e14607ca6c716
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  5H2Dncp5pKNO.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\5H2Dncp5pKNO.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4c79649090e4bf223ef0d2e0a19f1b7b135fa572f232478f16eb8c66bf997fcc
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  68P1JmAHLP9M.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\68P1JmAHLP9M.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f3b3f566cd661160d5f80d21fb24636f5bc434b8049ec1381bce389f88443aed
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  6hZTC8mYCLMp.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\6hZTC8mYCLMp.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 afcc526c00540f5691a7082d5279bce6cb148ba1b4a7c5215c7d7ef34080bb05
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  7GuAwZmZYYP1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7GuAwZmZYYP1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 58398f74bb02ed8b5e08cd1f300db186c99d075ddc12bbba2d9a2098cf62e386
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ArbroV84CL9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ArbroV84CL9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7c2c202e72e9935563ebcfcf51db466e1ca49b3cadd755cda90453c0f3a6eee0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  BrJI8W0rjpmv.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\BrJI8W0rjpmv.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5fa75690e129b17dcaba3ed7d1a11dcbc54792002af6daee53f9d0b159f31dc5
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  D8pwqThRfUCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\D8pwqThRfUCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a117df63c072626e959f4ef4464ac9ab7a7c919bfd7843a36df829527403012c
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  Dxh92atKJR6v.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Dxh92atKJR6v.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5c96a2c2fbbffcd89b7f697b6e6e7572c95aa9e00ec9f6a1fbce19fc6dfc503c
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  EBYkDkOlsHpz.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EBYkDkOlsHpz.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6914c9114f144d49abc8fee584d9426a632296d4edc53b13831da7d72f2c576d
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  EQZ3Uht5NrFX.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EQZ3Uht5NrFX.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 07322776eb804c9d9a73d4b10ea160d6432302027218aa083802938d01dadef1
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  EVGruk5SpSbb.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\EVGruk5SpSbb.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 09069dcb5dd6e26f6683ea971a68cdf59b10daa68bc7d36271afb8ce2cda7e19
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ExHdbYK95ULj.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ExHdbYK95ULj.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b2d0fb076a619a6a207c51f65bd3895ccb538ab39321f7bb6f6157f36e629336
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  FbXlWGb6FVMg.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\FbXlWGb6FVMg.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 14f441c8281034824cc18b75cd1d789fae74f578e169d7e0daa7563a6d742a22
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  GJUBqBR6FFm1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GJUBqBR6FFm1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5c34275f8255089a00fbba274664097cdf0804115cb9c1f837cca8d41803be38
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  GRZysruWm5uw.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GRZysruWm5uw.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 78e73534dbba18d5024222e94e40079c8a78bce42cb00fe4e71598ba770c981b
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  GUKuMNeO5tkg.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GUKuMNeO5tkg.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a930ca37d4dcc2f2e6c8aa5434914c7f442afb52a9a06b7ca514a75056f45c31
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  H0slYLu0TgVC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\H0slYLu0TgVC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 795b6056a06b64b12e80b8feacb1cf3b33ac9855f9f286e956bab1b155c97616
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ImnRDBJbKbfK.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ImnRDBJbKbfK.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9e7676f77fa238a297df7ce4dbed12eac0a2fe8ce748a304930fcb937c5c32b0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  J3JIAp3TsRkX.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\J3JIAp3TsRkX.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 588aee25650c16473c3177fa5b3679f8a6fb86d0f79553b9855eb2e39233aca2
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  K0xlquz3lBnd.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\K0xlquz3lBnd.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fd2814aa3ce1db2a825b6b405c3142cbfd816384e943412d19c58532b1404a85
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  KNRdBuaaml4o.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\KNRdBuaaml4o.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ece4691c61741e0958c5b5183d6c38c40c6ef5be3b541ea7149d05d756139c3f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  KeZoffgCx2Em.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\KeZoffgCx2Em.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 019d5d301268041285b514b1ff03f43292ad60791613008e938fd48f1abd59c2
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  LkOv8ywQcRjH.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\LkOv8ywQcRjH.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a5908d4c596ac57bba062eaf1b34907fb5eea2595de832cb1d6fe3fc7d997efd
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  LxxaQCisqlzv.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\LxxaQCisqlzv.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 96f171d0adb4619b8cf41cc69198b4952f1528041f76e16aeaa9193f3ade30f6
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  NMdcU2uViKi1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\NMdcU2uViKi1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2f71fc14d2b5254bbac8d8b7f15c82cb59415b5d262676f078e33beb116be773
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  NSsYL8Sb58tc.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\NSsYL8Sb58tc.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 515008d1aee86f5e5513dfa0ed0a59290cac616e8b02aab0167a74f695190391
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  TQ4Fl2hMzjv7.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\TQ4Fl2hMzjv7.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 51dfe2a698f7d375d8709437d9068240bf897982f945f7e226a4608f7f76a20d
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  UYrM24PFqnZ9.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UYrM24PFqnZ9.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 917cbadcd64dadd532f249e82890d44d1f03e0a3f796e65e6767110076c674a5
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  UgPa2spQG7zi.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\UgPa2spQG7zi.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 bea95a0bff5f347ee6aa77e69945888663b8e76d5627af4ef3e795f5912241da
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  Um5wc6HCjxzo.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Um5wc6HCjxzo.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1557fb387a0f723be8cfe87703ff83b3d34211a370044d6f3be66ab5bd8f78f0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  V7Yi3bRPg7CU.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\V7Yi3bRPg7CU.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 985d30dc850f56c54880172b38bd783d61ef913719e7bba1a89eb4c0e5e0b3d2
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  VlRKUynQT7B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\VlRKUynQT7B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b0db0abb38d555588f8bce6b103e1b62422f9e05d7854a15a89e4da6bbc7fa59
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  Z0sdIasX6t5q.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Z0sdIasX6t5q.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ad48b749e2d1ec67d6f09b26dbb236eba1ae95f1f64e75ed9995e3b8c7da630f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ZRStSA6qOwl1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ZRStSA6qOwl1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2300f9bb965a919453e9396064ea23b02b33891b153b7f8d9c78723db06e9764
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ZVFuEwX5sAbk.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ZVFuEwX5sAbk.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b29db5f6f8d353b754259f2364cbe4af007b57d61678da86fa1b91f0e3994983
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  bczaWuvKPNDt.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\bczaWuvKPNDt.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 336df1e566542fa1d3d029bbded9a9adcce0bb4c4ae3fb41ee22783442ba8271
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  bwPnDoqg8ZTB.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\bwPnDoqg8ZTB.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 23c7723e5f3d1b737dae9c17c0a52f8e8123b76eec8538293209f8fbfd352bc0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  bzrBTndWEuTd.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\bzrBTndWEuTd.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 618222acdbfc1205ff89a3ce6ccf6332c3d58d8b0648088b011534e97daa00d9
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  dt66zDzsEhj4.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\dt66zDzsEhj4.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 55bd6d56d030cf0a34ebaf60dbb49f6c3f9d58f513401d0913b5f79a1bf82304
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  f8X4aPn8NEht.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\f8X4aPn8NEht.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fa28918f1f4a0fc76505c4b2b375f75fd901943b84cc6cec8fc457ca348af62d
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  hZjR9YUR2sqh.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hZjR9YUR2sqh.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c265b0091d655aa3bbba49fe46dc912ea24c30f9acceecfe655f20bb242daad9
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  iE2WhUhFT2fF.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iE2WhUhFT2fF.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2cfa4c55dacd5eb3d416b5c57214cbc3efbd2c82e9e36178b962008768771ef0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  iS88lLFSE4Y0.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iS88lLFSE4Y0.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a335102aaa99d6b32a51656fe4db23f2c220790da1439cda98ca10c0ac5fe345
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  iinxTo8vY1Ip.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\iinxTo8vY1Ip.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5dce35af973049edbd1e1d391febbd5fa96ed79a20a3b8c84077648fb8518677
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  m9FbY9FszunV.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\m9FbY9FszunV.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 950e45168c3e5d0692f98332582ffdb96c7ccfd2f2395e842c929ec742fb2e42
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  nhLP5qgheZqA.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nhLP5qgheZqA.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 47c33566ede700bf9ac96d9a91c800dd990b800f77a1fb4fef953276d55f0473
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  pHhDLHCCp3P7.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\pHhDLHCCp3P7.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3d93516d1d893628465d6a345582cadef01b20ae6eaf5b696f4030063ab28447
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  pvPM6ZsJghd3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\pvPM6ZsJghd3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1f62f1fec6cf6cdc639da2a2051fd9687bccc645ce754a7b65fb11547a2b8570
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  q002PMpBXb9O.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\q002PMpBXb9O.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7bad7128f6e7a080ef718e4d0b52b656ecd398760583a479bfddea813ad693db
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  r5zZ5SGOxqFI.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\r5zZ5SGOxqFI.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e1c66ba4566bc0b8d932f7e41aca23b74148ec87e6702f7dbf2c37919d44e03d
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  rPs7JhlstUkk.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\rPs7JhlstUkk.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7c5c7141c8f808763ff8bc6cbd286cf0c6b3910f14d662c12ea8fc5add94ae7e
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ufRr3kk9AjYW.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ufRr3kk9AjYW.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8998fba27172e5c223e5c0f83b24f001a352f71ed767c9615c6dd2d44ad5ff63
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  uvSMUV19D3ZL.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uvSMUV19D3ZL.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 71cdbbc76fd7e5c92d5f3174f4fed4751313dd09fabb4566db50fb077b48a1bb
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  woxjUD7D714r.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\woxjUD7D714r.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f64f499f7cbcf0274982f1595bfac4d98e42b0e0d21521e32d595c1627782967
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  xGRuWS2DM5sA.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\xGRuWS2DM5sA.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 da206006e5e2f51581c7ea905a64d859ff9e719b7ce356af9fd1c6ff88d83d49
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  xayJVFW50MA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\xayJVFW50MA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cad65785986d6d887d8f023e65d332feea9bf9263284234c4658f5316bcb6c67
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  yLZrAPs1GXA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\yLZrAPs1GXA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 de308f4c7ec3bb58275eedbf48e2293608e9c904a61e395328277f21a08ce547
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/3952-8-0x000000001B8A0000-0x000000001B8B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/5016-0-0x0000000000360000-0x000000000068C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/5016-1-0x000000001B190000-0x000000001B1A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download