ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65

Analysis

max time kernel
17s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
001.exe
Size 501KB
Sample260523-mbkhvsav7x
SHA256 ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65
MD5 914fc1daaf606db6468828ae73f23475
SHA1 79c971f0db70211ec8cf5ca25347b11cab4e1e15
SHA512 5f4e4340d16984e780fd267925d0e4b6f182bd859e1e89526a85be0a3fb631284f166a9a618bc0500103b55e078a15f4e58efbf01a2a83c6bbc433100b231766
SSDEEP 12288:+fx/eZe3fjd4inis1fCPgrHqXYlN7h0o7rw:EMe373nzWgrHDb7h/I
TLSH
T1D4B4C016D25A550AE4016576B910B46E5CC78CFC03BFC2B3BBCC8D2F648E4614AFA6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\UserInit.exe,C:\\Windows\\System32\\winnt32.exe"	001.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	001.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3260	takeown.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\winnt32.exe	001.exe
File opened for modification	C:\Windows\System32\winnt32.exe	001.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	1420	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	001.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	001.exe
Token: SeTakeOwnershipPrivilege	3260	takeown.exe
Token: SeIncreaseQuotaPrivilege	2928	WMIC.exe
Token: SeSecurityPrivilege	2928	WMIC.exe
Token: SeTakeOwnershipPrivilege	2928	WMIC.exe
Token: SeLoadDriverPrivilege	2928	WMIC.exe
Token: SeSystemProfilePrivilege	2928	WMIC.exe
Token: SeSystemtimePrivilege	2928	WMIC.exe
Token: SeProfSingleProcessPrivilege	2928	WMIC.exe
Token: SeIncBasePriorityPrivilege	2928	WMIC.exe
Token: SeCreatePagefilePrivilege	2928	WMIC.exe
Token: SeBackupPrivilege	2928	WMIC.exe
Token: SeRestorePrivilege	2928	WMIC.exe
Token: SeShutdownPrivilege	2928	WMIC.exe
Token: SeDebugPrivilege	2928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2928	WMIC.exe
Token: SeRemoteShutdownPrivilege	2928	WMIC.exe
Token: SeUndockPrivilege	2928	WMIC.exe
Token: SeManageVolumePrivilege	2928	WMIC.exe
Token: 33	2928	WMIC.exe
Token: 34	2928	WMIC.exe
Token: 35	2928	WMIC.exe
Token: 36	2928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2928	WMIC.exe
Token: SeSecurityPrivilege	2928	WMIC.exe
Token: SeTakeOwnershipPrivilege	2928	WMIC.exe
Token: SeLoadDriverPrivilege	2928	WMIC.exe
Token: SeSystemProfilePrivilege	2928	WMIC.exe
Token: SeSystemtimePrivilege	2928	WMIC.exe
Token: SeProfSingleProcessPrivilege	2928	WMIC.exe
Token: SeIncBasePriorityPrivilege	2928	WMIC.exe
Token: SeCreatePagefilePrivilege	2928	WMIC.exe
Token: SeBackupPrivilege	2928	WMIC.exe
Token: SeRestorePrivilege	2928	WMIC.exe
Token: SeShutdownPrivilege	2928	WMIC.exe
Token: SeDebugPrivilege	2928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2928	WMIC.exe
Token: SeRemoteShutdownPrivilege	2928	WMIC.exe
Token: SeUndockPrivilege	2928	WMIC.exe
Token: SeManageVolumePrivilege	2928	WMIC.exe
Token: 33	2928	WMIC.exe
Token: 34	2928	WMIC.exe
Token: 35	2928	WMIC.exe
Token: 36	2928	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3260	1420	001.exe	96
PID 1420 wrote to memory of 5972	1420	001.exe	98
PID 1420 wrote to memory of 4904	1420	001.exe	100
PID 1420 wrote to memory of 2940	1420	001.exe	102
PID 1420 wrote to memory of 5044	1420	001.exe	104
PID 4904 wrote to memory of 2928	4904	cmd.exe	106
PID 1420 wrote to memory of 1072	1420	001.exe	107
PID 5972 wrote to memory of 5852	5972	cmd.exe	109
PID 1420 wrote to memory of 5488	1420	001.exe	110
PID 5852 wrote to memory of 2248	5852	net.exe	111
PID 2940 wrote to memory of 5860	2940	cmd.exe	113
PID 5860 wrote to memory of 3724	5860	net.exe	390
PID 1420 wrote to memory of 5704	1420	001.exe	115
PID 1420 wrote to memory of 2424	1420	001.exe	117
PID 1420 wrote to memory of 5108	1420	001.exe	119
PID 5044 wrote to memory of 3572	5044	cmd.exe	121
PID 3572 wrote to memory of 5440	3572	net.exe	122
PID 1420 wrote to memory of 5100	1420	001.exe	123
PID 1420 wrote to memory of 1412	1420	001.exe	125
PID 1072 wrote to memory of 3552	1072	cmd.exe	126
PID 3552 wrote to memory of 4488	3552	net.exe	407
PID 1420 wrote to memory of 1660	1420	001.exe	129
PID 5488 wrote to memory of 3536	5488	cmd.exe	131
PID 1420 wrote to memory of 4240	1420	001.exe	132
PID 3536 wrote to memory of 1848	3536	net.exe	220
PID 1420 wrote to memory of 224	1420	001.exe	135
PID 2424 wrote to memory of 3696	2424	cmd.exe	137
PID 1420 wrote to memory of 972	1420	001.exe	138
PID 3696 wrote to memory of 3636	3696	net.exe	465
PID 1420 wrote to memory of 1144	1420	001.exe	141
PID 1420 wrote to memory of 1532	1420	001.exe	143
PID 5704 wrote to memory of 1812	5704	cmd.exe	145
PID 1420 wrote to memory of 5136	1420	001.exe	146
PID 1812 wrote to memory of 3708	1812	net.exe	147
PID 1420 wrote to memory of 1156	1420	001.exe	149
PID 5108 wrote to memory of 1744	5108	cmd.exe	151
PID 1412 wrote to memory of 976	1412	cmd.exe	152
PID 1420 wrote to memory of 6036	1420	001.exe	153
PID 5100 wrote to memory of 4972	5100	cmd.exe	154
PID 4240 wrote to memory of 1820	4240	cmd.exe	156
PID 1420 wrote to memory of 2132	1420	001.exe	157
PID 976 wrote to memory of 5584	976	net.exe	362
PID 1744 wrote to memory of 1336	1744	net.exe	501
PID 4972 wrote to memory of 2632	4972	net.exe	161
PID 1660 wrote to memory of 5884	1660	cmd.exe	162
PID 1820 wrote to memory of 1352	1820	net.exe	163
PID 1420 wrote to memory of 5948	1420	001.exe	164
PID 224 wrote to memory of 3100	224	cmd.exe	166
PID 1420 wrote to memory of 5192	1420	001.exe	167
PID 3100 wrote to memory of 1912	3100	net.exe	168
PID 5884 wrote to memory of 1064	5884	net.exe	323
PID 1420 wrote to memory of 5920	1420	001.exe	171
PID 1144 wrote to memory of 2672	1144	cmd.exe	173
PID 972 wrote to memory of 4480	972	cmd.exe	174
PID 1420 wrote to memory of 4280	1420	001.exe	175
PID 1532 wrote to memory of 4460	1532	cmd.exe	176
PID 1156 wrote to memory of 2808	1156	cmd.exe	177
PID 2672 wrote to memory of 4456	2672	net.exe	178
PID 2808 wrote to memory of 4420	2808	net.exe	180
PID 4460 wrote to memory of 5376	4460	net.exe	370
PID 1420 wrote to memory of 4540	1420	001.exe	182
PID 4480 wrote to memory of 5092	4480	net.exe	183
PID 1420 wrote to memory of 4388	1420	001.exe	185
PID 5136 wrote to memory of 4648	5136	cmd.exe	187

C:\Users\Admin\AppData\Local\Temp\001.exe
"C:\Users\Admin\AppData\Local\Temp\001.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /F C:\Windows\System32
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user %username% NT32err0r
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\net.exe
    net user Admin NT32err0r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin NT32err0r
      4⤵
      PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic useraccount where name='%username%' rename '0xc666'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename '0xc666'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "耍槄葢溾劚檼稲嚝卢笮魅说姐" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\net.exe
    net user "耍槄葢溾劚檼稲嚝卢笮魅说姐" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "耍槄葢溾劚檼稲嚝卢笮魅说姐" /random /add
      4⤵
      PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "嚳鰁閠翊熕冹鵡亞脒楺榪愆鯯" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\net.exe
    net user "嚳鰁閠翊熕冹鵡亞脒楺榪愆鯯" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "嚳鰁閠翊熕冹鵡亞脒楺榪愆鯯" /random /add
      4⤵
      PID:5440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "支櫖鞡髪袼髙剱牘傖嘶芟箠荴" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\net.exe
    net user "支櫖鞡髪袼髙剱牘傖嘶芟箠荴" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "支櫖鞡髪袼髙剱牘傖嘶芟箠荴" /random /add
      4⤵
      PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "儽捻閕飿祠蘤焅栮翴烽畓愀槬" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\net.exe
    net user "儽捻閕飿祠蘤焅栮翴烽畓愀槬" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "儽捻閕飿祠蘤焅栮翴烽畓愀槬" /random /add
      4⤵
      PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "郼疉楱躰璀嵶鸝慽遹龘袉袗辀" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\system32\net.exe
    net user "郼疉楱躰璀嵶鸝慽遹龘袉袗辀" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "郼疉楱躰璀嵶鸝慽遹龘袉袗辀" /random /add
      4⤵
      PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "塻繻蟠尷返珷壒丰孙庚燛宰笂" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\net.exe
    net user "塻繻蟠尷返珷壒丰孙庚燛宰笂" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "塻繻蟠尷返珷壒丰孙庚燛宰笂" /random /add
      4⤵
      PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "捴掻飧彦瀠爕楺轼傆崓毽俿貲" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\net.exe
    net user "捴掻飧彦瀠爕楺轼傆崓毽俿貲" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "捴掻飧彦瀠爕楺轼傆崓毽俿貲" /random /add
      4⤵
      PID:1336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鉨惛袊蛑诋粴鏚嶗両罱挱谱哎" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\net.exe
    net user "鉨惛袊蛑诋粴鏚嶗両罱挱谱哎" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鉨惛袊蛑诋粴鏚嶗両罱挱谱哎" /random /add
      4⤵
      PID:2632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "賃衶腉饵滈仁恟黈撨屿偅鄀讏" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\net.exe
    net user "賃衶腉饵滈仁恟黈撨屿偅鄀讏" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "賃衶腉饵滈仁恟黈撨屿偅鄀讏" /random /add
      4⤵
      PID:5584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "閖禑鱬瑊凄坹珊嫀锢娽鲺赇櫰" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\net.exe
    net user "閖禑鱬瑊凄坹珊嫀锢娽鲺赇櫰" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "閖禑鱬瑊凄坹珊嫀锢娽鲺赇櫰" /random /add
      4⤵
      PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鰒紋湙掞獹楝榋厱揀吚薺婸噊" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\net.exe
    net user "鰒紋湙掞獹楝榋厱揀吚薺婸噊" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鰒紋湙掞獹楝榋厱揀吚薺婸噊" /random /add
      4⤵
      PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "廼塔弰咚抎荍热躑銴權鏨詡串" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\net.exe
    net user "廼塔弰咚抎荍热躑銴權鏨詡串" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "廼塔弰咚抎荍热躑銴權鏨詡串" /random /add
      4⤵
      PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鴼馸護纠妽姠韬樥藟傫続満迫" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\net.exe
    net user "鴼馸護纠妽姠韬樥藟傫続満迫" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鴼馸護纠妽姠韬樥藟傫続満迫" /random /add
      4⤵
      PID:5092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "應咙攀憬伏簃辟薧域掴燓竎秳" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\net.exe
    net user "應咙攀憬伏簃辟薧域掴燓竎秳" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "應咙攀憬伏簃辟薧域掴燓竎秳" /random /add
      4⤵
      PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "孂醗噴苶鏤俅儉棻霋簽烷濙潄" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\net.exe
    net user "孂醗噴苶鏤俅儉棻霋簽烷濙潄" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "孂醗噴苶鏤俅儉棻霋簽烷濙潄" /random /add
      4⤵
      PID:5376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "殷薊霆鎠焳柇囙歮眰朩阎浈羿" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\net.exe
    net user "殷薊霆鎠焳柇囙歮眰朩阎浈羿" /random /add
    3⤵
    PID:4648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "殷薊霆鎠焳柇囙歮眰朩阎浈羿" /random /add
      4⤵
      PID:868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "犃璹皃荩莩口粉荔醕饊彚孲緖" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\net.exe
    net user "犃璹皃荩莩口粉荔醕饊彚孲緖" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "犃璹皃荩莩口粉荔醕饊彚孲緖" /random /add
      4⤵
      PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "麻勺鿃呠涑蝷虿菡緦囟俵淤犛" /random /add
  2⤵
  PID:6036
- - C:\Windows\system32\net.exe
    net user "麻勺鿃呠涑蝷虿菡緦囟俵淤犛" /random /add
    3⤵
    PID:5476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "麻勺鿃呠涑蝷虿菡緦囟俵淤犛" /random /add
      4⤵
      PID:5468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "彽怄嘒裵淢躐髧廄裇凚櫳鋝獨" /random /add
  2⤵
  PID:2132
- - C:\Windows\system32\net.exe
    net user "彽怄嘒裵淢躐髧廄裇凚櫳鋝獨" /random /add
    3⤵
    PID:4740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "彽怄嘒裵淢躐髧廄裇凚櫳鋝獨" /random /add
      4⤵
      PID:3388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "溢哑涓龫枖禚枛斧望檡圵邊淀" /random /add
  2⤵
  PID:5948
- - C:\Windows\system32\net.exe
    net user "溢哑涓龫枖禚枛斧望檡圵邊淀" /random /add
    3⤵
    PID:5608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "溢哑涓龫枖禚枛斧望檡圵邊淀" /random /add
      4⤵
      PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "崡搊微芷级蜤蠩琗璆叩扷靟菴" /random /add
  2⤵
  PID:5192
- - C:\Windows\system32\net.exe
    net user "崡搊微芷级蜤蠩琗璆叩扷靟菴" /random /add
    3⤵
    PID:2124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "崡搊微芷级蜤蠩琗璆叩扷靟菴" /random /add
      4⤵
      PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "閸實郹错銾藈笇礯匴茙輼閩淦" /random /add
  2⤵
  PID:5920
- - C:\Windows\system32\net.exe
    net user "閸實郹错銾藈笇礯匴茙輼閩淦" /random /add
    3⤵
    PID:3360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "閸實郹错銾藈笇礯匴茙輼閩淦" /random /add
      4⤵
      PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "卒葢刃詰诧衻垔鱇擩詋泹岍歼" /random /add
  2⤵
  PID:4280
- - C:\Windows\system32\net.exe
    net user "卒葢刃詰诧衻垔鱇擩詋泹岍歼" /random /add
    3⤵
    PID:3116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "卒葢刃詰诧衻垔鱇擩詋泹岍歼" /random /add
      4⤵
      PID:5160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "姧嵞擩斫鸁搇譡沌晻曫梕轴臽" /random /add
  2⤵
  PID:4540
- - C:\Windows\system32\net.exe
    net user "姧嵞擩斫鸁搇譡沌晻曫梕轴臽" /random /add
    3⤵
    PID:1384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "姧嵞擩斫鸁搇譡沌晻曫梕轴臽" /random /add
      4⤵
      PID:5616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "唎的泯锳蚷澍肪飤尥岼蜓涼睠" /random /add
  2⤵
  PID:4388
- - C:\Windows\system32\net.exe
    net user "唎的泯锳蚷澍肪飤尥岼蜓涼睠" /random /add
    3⤵
    PID:964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "唎的泯锳蚷澍肪飤尥岼蜓涼睠" /random /add
      4⤵
      PID:416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "饷偣妥苘炿绍兗姁箦楕跫殽乩" /random /add
  2⤵
  PID:4632
- - C:\Windows\system32\net.exe
    net user "饷偣妥苘炿绍兗姁箦楕跫殽乩" /random /add
    3⤵
    PID:4748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "饷偣妥苘炿绍兗姁箦楕跫殽乩" /random /add
      4⤵
      PID:5836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "恅滮濰麼潨靽澜窦溟姹待寫府" /random /add
  2⤵
  PID:3392
- - C:\Windows\system32\net.exe
    net user "恅滮濰麼潨靽澜窦溟姹待寫府" /random /add
    3⤵
    PID:4816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "恅滮濰麼潨靽澜窦溟姹待寫府" /random /add
      4⤵
      PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "洷鯉納峿渫嬳鏛樤禳衟葤悘僻" /random /add
  2⤵
  PID:5072
- - C:\Windows\system32\net.exe
    net user "洷鯉納峿渫嬳鏛樤禳衟葤悘僻" /random /add
    3⤵
    PID:2784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "洷鯉納峿渫嬳鏛樤禳衟葤悘僻" /random /add
      4⤵
      PID:3808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "苚柌鲑銟裩獭趰褟縧鿵糙尢碋" /random /add
  2⤵
  PID:4848
- - C:\Windows\system32\net.exe
    net user "苚柌鲑銟裩獭趰褟縧鿵糙尢碋" /random /add
    3⤵
    PID:4028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "苚柌鲑銟裩獭趰褟縧鿵糙尢碋" /random /add
      4⤵
      PID:3280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "睦报賊钄巿嚾棢算駴鏩秪戫伺" /random /add
  2⤵
  PID:3816
- - C:\Windows\system32\net.exe
    net user "睦报賊钄巿嚾棢算駴鏩秪戫伺" /random /add
    3⤵
    PID:1380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "睦报賊钄巿嚾棢算駴鏩秪戫伺" /random /add
      4⤵
      PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "舓傼蔪繈祮髂田閒鍭鋫凬掞毆" /random /add
  2⤵
  PID:3796
- - C:\Windows\system32\net.exe
    net user "舓傼蔪繈祮髂田閒鍭鋫凬掞毆" /random /add
    3⤵
    PID:5900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "舓傼蔪繈祮髂田閒鍭鋫凬掞毆" /random /add
      4⤵
      PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "呴榉苣揜皝丨徘鱜系鮝密喠幄" /random /add
  2⤵
  PID:6004
- - C:\Windows\system32\net.exe
    net user "呴榉苣揜皝丨徘鱜系鮝密喠幄" /random /add
    3⤵
    PID:5324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "呴榉苣揜皝丨徘鱜系鮝密喠幄" /random /add
      4⤵
      PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "攌鐥簬鳉鍷釅愨絷臼和爂订莹" /random /add
  2⤵
  PID:1848
- - C:\Windows\system32\net.exe
    net user "攌鐥簬鳉鍷釅愨絷臼和爂订莹" /random /add
    3⤵
    PID:4992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "攌鐥簬鳉鍷釅愨絷臼和爂订莹" /random /add
      4⤵
      PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "澽讪盽阾嵨記浩萜脫愐揓曚煵" /random /add
  2⤵
  PID:4936
- - C:\Windows\system32\net.exe
    net user "澽讪盽阾嵨記浩萜脫愐揓曚煵" /random /add
    3⤵
    PID:6044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "澽讪盽阾嵨記浩萜脫愐揓曚煵" /random /add
      4⤵
      PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "瘘恊陨瘥浾葑勑櫅馹客釾富魵" /random /add
  2⤵
  PID:5216
- - C:\Windows\system32\net.exe
    net user "瘘恊陨瘥浾葑勑櫅馹客釾富魵" /random /add
    3⤵
    PID:3240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "瘘恊陨瘥浾葑勑櫅馹客釾富魵" /random /add
      4⤵
      PID:6020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "罚邗蘁緒済蟆荤汶枦禘潿霣羂" /random /add
  2⤵
  PID:2084
- - C:\Windows\system32\net.exe
    net user "罚邗蘁緒済蟆荤汶枦禘潿霣羂" /random /add
    3⤵
    PID:3408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "罚邗蘁緒済蟆荤汶枦禘潿霣羂" /random /add
      4⤵
      PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "捏蔨圍椔尷衞炇陈瞔霨钘攑緌" /random /add
  2⤵
  PID:1580
- - C:\Windows\system32\net.exe
    net user "捏蔨圍椔尷衞炇陈瞔霨钘攑緌" /random /add
    3⤵
    PID:2160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "捏蔨圍椔尷衞炇陈瞔霨钘攑緌" /random /add
      4⤵
      PID:4292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鞸栽牰璱辈滀钱玪界壜蘘姗请" /random /add
  2⤵
  PID:4176
- - C:\Windows\system32\net.exe
    net user "鞸栽牰璱辈滀钱玪界壜蘘姗请" /random /add
    3⤵
    PID:2676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鞸栽牰璱辈滀钱玪界壜蘘姗请" /random /add
      4⤵
      PID:5692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "莹辁辎覅鸐蔯殲啲鐢襍郎愴針" /random /add
  2⤵
  PID:1468
- - C:\Windows\system32\net.exe
    net user "莹辁辎覅鸐蔯殲啲鐢襍郎愴針" /random /add
    3⤵
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "莹辁辎覅鸐蔯殲啲鐢襍郎愴針" /random /add
      4⤵
      PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "佇脡噴萍蟻娂瀇愄蘟睂翼鹻臙" /random /add
  2⤵
  PID:1684
- - C:\Windows\system32\net.exe
    net user "佇脡噴萍蟻娂瀇愄蘟睂翼鹻臙" /random /add
    3⤵
    PID:412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "佇脡噴萍蟻娂瀇愄蘟睂翼鹻臙" /random /add
      4⤵
      PID:5256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "頂麜屣艧莨汫曶騘烌攲骟锧臀" /random /add
  2⤵
  PID:3000
- - C:\Windows\system32\net.exe
    net user "頂麜屣艧莨汫曶騘烌攲骟锧臀" /random /add
    3⤵
    PID:1564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "頂麜屣艧莨汫曶騘烌攲骟锧臀" /random /add
      4⤵
      PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "谺愅瞎樽眡谔焜亦摐缋蜞坻簮" /random /add
  2⤵
  PID:4572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3388
- - C:\Windows\system32\net.exe
    net user "谺愅瞎樽眡谔焜亦摐缋蜞坻簮" /random /add
    3⤵
    PID:4924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "谺愅瞎樽眡谔焜亦摐缋蜞坻簮" /random /add
      4⤵
      PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "曉埊赟鐉垫拳讒祝腫嘸儕偺蜆" /random /add
  2⤵
  PID:728
- - C:\Windows\system32\net.exe
    net user "曉埊赟鐉垫拳讒祝腫嘸儕偺蜆" /random /add
    3⤵
    PID:5964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "曉埊赟鐉垫拳讒祝腫嘸儕偺蜆" /random /add
      4⤵
      PID:5412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "恍墆夳褯姛弙穄芄疎攡播剶苹" /random /add
  2⤵
  PID:1296
- - C:\Windows\system32\net.exe
    net user "恍墆夳褯姛弙穄芄疎攡播剶苹" /random /add
    3⤵
    PID:2000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "恍墆夳褯姛弙穄芄疎攡播剶苹" /random /add
      4⤵
      PID:608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "殱諍蓄殡鱜限捚僨衸圅鼣硽石" /random /add
  2⤵
  PID:5796
- - C:\Windows\system32\net.exe
    net user "殱諍蓄殡鱜限捚僨衸圅鼣硽石" /random /add
    3⤵
    PID:1224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "殱諍蓄殡鱜限捚僨衸圅鼣硽石" /random /add
      4⤵
      PID:3512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "憧鵚窌楕乞売諧靕諚娰嘝爟抹" /random /add
  2⤵
  PID:5804
- - C:\Windows\system32\net.exe
    net user "憧鵚窌楕乞売諧靕諚娰嘝爟抹" /random /add
    3⤵
    PID:2844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "憧鵚窌楕乞売諧靕諚娰嘝爟抹" /random /add
      4⤵
      PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "稖燮鎑寷挄繧迼譵窏虆傜鱘胩" /random /add
  2⤵
  PID:4896
- - C:\Windows\system32\net.exe
    net user "稖燮鎑寷挄繧迼譵窏虆傜鱘胩" /random /add
    3⤵
    PID:2240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "稖燮鎑寷挄繧迼譵窏虆傜鱘胩" /random /add
      4⤵
      PID:6052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鸿繶濣棜贠舾衪瑓瑦藇脪叞恑" /random /add
  2⤵
  PID:64
- - C:\Windows\system32\net.exe
    net user "鸿繶濣棜贠舾衪瑓瑦藇脪叞恑" /random /add
    3⤵
    PID:5344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鸿繶濣棜贠舾衪瑓瑦藇脪叞恑" /random /add
      4⤵
      PID:3348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "镦孵潔嫰僳鯣魸躞氈歀竷穴驵" /random /add
  2⤵
  PID:5788
- - C:\Windows\system32\net.exe
    net user "镦孵潔嫰僳鯣魸躞氈歀竷穴驵" /random /add
    3⤵
    PID:5492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "镦孵潔嫰僳鯣魸躞氈歀竷穴驵" /random /add
      4⤵
      PID:5260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "滿泒逫塤跐蚤位臦嘁鼏灉嘺錢" /random /add
  2⤵
  PID:5336
- - C:\Windows\system32\net.exe
    net user "滿泒逫塤跐蚤位臦嘁鼏灉嘺錢" /random /add
    3⤵
    PID:4204
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "滿泒逫塤跐蚤位臦嘁鼏灉嘺錢" /random /add
      4⤵
      PID:4312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "纊鉀恁啊魏鰬虹屒魰耪絍示腚" /random /add
  2⤵
  PID:2472
- - C:\Windows\system32\net.exe
    net user "纊鉀恁啊魏鰬虹屒魰耪絍示腚" /random /add
    3⤵
    PID:632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "纊鉀恁啊魏鰬虹屒魰耪絍示腚" /random /add
      4⤵
      PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "犘沯笲鳮揻記檄鴫鸩穕礱饪縖" /random /add
  2⤵
  PID:3276
- - C:\Windows\system32\net.exe
    net user "犘沯笲鳮揻記檄鴫鸩穕礱饪縖" /random /add
    3⤵
    PID:2108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "犘沯笲鳮揻記檄鴫鸩穕礱饪縖" /random /add
      4⤵
      PID:5996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鰙雘崅垊噞哫紡啈懼拕鐷鰗殟" /random /add
  2⤵
  PID:4892
- - C:\Windows\system32\net.exe
    net user "鰙雘崅垊噞哫紡啈懼拕鐷鰗殟" /random /add
    3⤵
    PID:1064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鰙雘崅垊噞哫紡啈懼拕鐷鰗殟" /random /add
      4⤵
      PID:6008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鳠蜘酋傹狾曼悴鞑髒湙鮏繉此" /random /add
  2⤵
  PID:2692
- - C:\Windows\system32\net.exe
    net user "鳠蜘酋傹狾曼悴鞑髒湙鮏繉此" /random /add
    3⤵
    PID:2708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鳠蜘酋傹狾曼悴鞑髒湙鮏繉此" /random /add
      4⤵
      PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "犪篘襯郺婇祧詋鄇劈帞滨蚐荦" /random /add
  2⤵
  PID:2316
- - C:\Windows\system32\net.exe
    net user "犪篘襯郺婇祧詋鄇劈帞滨蚐荦" /random /add
    3⤵
    PID:2600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "犪篘襯郺婇祧詋鄇劈帞滨蚐荦" /random /add
      4⤵
      PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "庪聏氄橺版鹕蹞堮繟筍西鮋鋋" /random /add
  2⤵
  PID:4524
- - C:\Windows\system32\net.exe
    net user "庪聏氄橺版鹕蹞堮繟筍西鮋鋋" /random /add
    3⤵
    PID:1728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "庪聏氄橺版鹕蹞堮繟筍西鮋鋋" /random /add
      4⤵
      PID:4144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "湀灆惺軤飸衹璆畾嵘摗攣糺轡" /random /add
  2⤵
  PID:2500
- - C:\Windows\system32\net.exe
    net user "湀灆惺軤飸衹璆畾嵘摗攣糺轡" /random /add
    3⤵
    PID:4712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "湀灆惺軤飸衹璆畾嵘摗攣糺轡" /random /add
      4⤵
      PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "筹顮衛兕豤拷鴤辎鈘峕吿鯶實" /random /add
  2⤵
  PID:3288
- - C:\Windows\system32\net.exe
    net user "筹顮衛兕豤拷鴤辎鈘峕吿鯶實" /random /add
    3⤵
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "筹顮衛兕豤拷鴤辎鈘峕吿鯶實" /random /add
      4⤵
      PID:5984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "煒续驪坵責嶑碅榅刱緋掓蟯厺" /random /add
  2⤵
  PID:5844
- - C:\Windows\system32\net.exe
    net user "煒续驪坵責嶑碅榅刱緋掓蟯厺" /random /add
    3⤵
    PID:884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "煒续驪坵責嶑碅榅刱緋掓蟯厺" /random /add
      4⤵
      PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "驚櫾輾斍紃煹渃嶫愅饘模躻湾" /random /add
  2⤵
  PID:3648
- - C:\Windows\system32\net.exe
    net user "驚櫾輾斍紃煹渃嶫愅饘模躻湾" /random /add
    3⤵
    PID:1528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "驚櫾輾斍紃煹渃嶫愅饘模躻湾" /random /add
      4⤵
      PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "莜妬框閭埵嚽礋鳄拮吒粦缈葻" /random /add
  2⤵
  PID:2412
- - C:\Windows\system32\net.exe
    net user "莜妬框閭埵嚽礋鳄拮吒粦缈葻" /random /add
    3⤵
    PID:5584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "莜妬框閭埵嚽礋鳄拮吒粦缈葻" /random /add
      4⤵
      PID:5808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "暼欐挸篗锍铜墂挑靍乵稡僚聨" /random /add
  2⤵
  PID:6024
- - C:\Windows\system32\net.exe
    net user "暼欐挸篗锍铜墂挑靍乵稡僚聨" /random /add
    3⤵
    PID:3484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "暼欐挸篗锍铜墂挑靍乵稡僚聨" /random /add
      4⤵
      PID:2936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "芁蓐鉃鯚竱稔殢祖篰談蘚村苖" /random /add
  2⤵
  PID:2856
- - C:\Windows\system32\net.exe
    net user "芁蓐鉃鯚竱稔殢祖篰談蘚村苖" /random /add
    3⤵
    PID:5660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "芁蓐鉃鯚竱稔殢祖篰談蘚村苖" /random /add
      4⤵
      PID:3916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "刷备怴惭缣橰夹葮牝嘅肱鵏肢" /random /add
  2⤵
  PID:4324
- - C:\Windows\system32\net.exe
    net user "刷备怴惭缣橰夹葮牝嘅肱鵏肢" /random /add
    3⤵
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "刷备怴惭缣橰夹葮牝嘅肱鵏肢" /random /add
      4⤵
      PID:5112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "埾媎澣魓笯湕钎鸺誒赐麑玲荟" /random /add
  2⤵
  PID:5928
- - C:\Windows\system32\net.exe
    net user "埾媎澣魓笯湕钎鸺誒赐麑玲荟" /random /add
    3⤵
    PID:5408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "埾媎澣魓笯湕钎鸺誒赐麑玲荟" /random /add
      4⤵
      PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "曪穂篒椧鹄鬖镺訋媽鏫按賃恄" /random /add
  2⤵
  PID:5932
- - C:\Windows\system32\net.exe
    net user "曪穂篒椧鹄鬖镺訋媽鏫按賃恄" /random /add
    3⤵
    PID:1752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "曪穂篒椧鹄鬖镺訋媽鏫按賃恄" /random /add
      4⤵
      PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "粖漿囉硤唲迉輮蟡哎邙跠砧貒" /random /add
  2⤵
  PID:4528
- - C:\Windows\system32\net.exe
    net user "粖漿囉硤唲迉輮蟡哎邙跠砧貒" /random /add
    3⤵
    PID:4060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "粖漿囉硤唲迉輮蟡哎邙跠砧貒" /random /add
      4⤵
      PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "商匶瑨唢顗猍饷嚼羂瘂倾撯槽" /random /add
  2⤵
  PID:692
- - C:\Windows\system32\net.exe
    net user "商匶瑨唢顗猍饷嚼羂瘂倾撯槽" /random /add
    3⤵
    PID:1864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "商匶瑨唢顗猍饷嚼羂瘂倾撯槽" /random /add
      4⤵
      PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "布硡衁鯐犣傀酬録謠犘鬂晾闤" /random /add
  2⤵
  PID:3936
- - C:\Windows\system32\net.exe
    net user "布硡衁鯐犣傀酬録謠犘鬂晾闤" /random /add
    3⤵
    PID:5400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "布硡衁鯐犣傀酬録謠犘鬂晾闤" /random /add
      4⤵
      PID:5984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "腴厝琽欴韬鏒睎赃盒脈窦勩骨" /random /add
  2⤵
  PID:3512
- - C:\Windows\system32\net.exe
    net user "腴厝琽欴韬鏒睎赃盒脈窦勩骨" /random /add
    3⤵
    PID:3132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "腴厝琽欴韬鏒睎赃盒脈窦勩骨" /random /add
      4⤵
      PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "徙棞鞳冲菗鞳蒶齝抶硄靴朘媄" /random /add
  2⤵
  PID:5376
- - C:\Windows\system32\net.exe
    net user "徙棞鞳冲菗鞳蒶齝抶硄靴朘媄" /random /add
    3⤵
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "徙棞鞳冲菗鞳蒶齝抶硄靴朘媄" /random /add
      4⤵
      PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鈝弑趩嶂謳厞獦烓后輳埌鲿豚" /random /add
  2⤵
  PID:3456
- - C:\Windows\system32\net.exe
    net user "鈝弑趩嶂謳厞獦烓后輳埌鲿豚" /random /add
    3⤵
    PID:836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鈝弑趩嶂謳厞獦烓后輳埌鲿豚" /random /add
      4⤵
      PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "芣酈彰榩弚蘻諅柊濨慂桒纶醄" /random /add
  2⤵
  PID:4884
- - C:\Windows\system32\net.exe
    net user "芣酈彰榩弚蘻諅柊濨慂桒纶醄" /random /add
    3⤵
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "芣酈彰榩弚蘻諅柊濨慂桒纶醄" /random /add
      4⤵
      PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "閁褃愨寅鄼轸徶齉蹜鉎蝨胅辌" /random /add
  2⤵
  PID:2300
- - C:\Windows\system32\net.exe
    net user "閁褃愨寅鄼轸徶齉蹜鉎蝨胅辌" /random /add
    3⤵
    PID:2800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "閁褃愨寅鄼轸徶齉蹜鉎蝨胅辌" /random /add
      4⤵
      PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "濫梧珏鐸睵乵濨嶨孒韝瘴滵鸑" /random /add
  2⤵
  PID:4252
- - C:\Windows\system32\net.exe
    net user "濫梧珏鐸睵乵濨嶨孒韝瘴滵鸑" /random /add
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "濫梧珏鐸睵乵濨嶨孒韝瘴滵鸑" /random /add
      4⤵
      PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "衖韆轱弸冻窔蜃汯怇拡屽踁顏" /random /add
  2⤵
  PID:5124
- - C:\Windows\system32\net.exe
    net user "衖韆轱弸冻窔蜃汯怇拡屽踁顏" /random /add
    3⤵
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "衖韆轱弸冻窔蜃汯怇拡屽踁顏" /random /add
      4⤵
      PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "耐螯襗鳼娺噀儭籬鼜瀮噕峨饬" /random /add
  2⤵
  PID:1612
- - C:\Windows\system32\net.exe
    net user "耐螯襗鳼娺噀儭籬鼜瀮噕峨饬" /random /add
    3⤵
    PID:644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "耐螯襗鳼娺噀儭籬鼜瀮噕峨饬" /random /add
      4⤵
      PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "媆秨聪嘿憂烺孫鱌憗砏聘鄂俔" /random /add
  2⤵
  PID:408
- - C:\Windows\system32\net.exe
    net user "媆秨聪嘿憂烺孫鱌憗砏聘鄂俔" /random /add
    3⤵
    PID:1588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "媆秨聪嘿憂烺孫鱌憗砏聘鄂俔" /random /add
      4⤵
      PID:5076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鄱徾柲磭翻初镙來菹鉈灮矗鯱" /random /add
  2⤵
  PID:2252
- - C:\Windows\system32\net.exe
    net user "鄱徾柲磭翻初镙來菹鉈灮矗鯱" /random /add
    3⤵
    PID:3092
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鄱徾柲磭翻初镙來菹鉈灮矗鯱" /random /add
      4⤵
      PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "壦来榏沐婣嵚絮玐曩後葖驿仹" /random /add
  2⤵
  PID:1836
- - C:\Windows\system32\net.exe
    net user "壦来榏沐婣嵚絮玐曩後葖驿仹" /random /add
    3⤵
    PID:2304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "壦来榏沐婣嵚絮玐曩後葖驿仹" /random /add
      4⤵
      PID:5984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蘋溙麦碉锠廤鯤辈蓢庱绲愆鰜" /random /add
  2⤵
  PID:4668
- - C:\Windows\system32\net.exe
    net user "蘋溙麦碉锠廤鯤辈蓢庱绲愆鰜" /random /add
    3⤵
    PID:956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蘋溙麦碉锠廤鯤辈蓢庱绲愆鰜" /random /add
      4⤵
      PID:5768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "刧捡圩鹤諙痱楱屗虽樎芅悮櫵" /random /add
  2⤵
  PID:4144
- - C:\Windows\system32\net.exe
    net user "刧捡圩鹤諙痱楱屗虽樎芅悮櫵" /random /add
    3⤵
    PID:4148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "刧捡圩鹤諙痱楱屗虽樎芅悮櫵" /random /add
      4⤵
      PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鈴锄擨匥埸毓轥娊舯霃凘啁欕" /random /add
  2⤵
  PID:2456
- - C:\Windows\system32\net.exe
    net user "鈴锄擨匥埸毓轥娊舯霃凘啁欕" /random /add
    3⤵
    PID:5980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鈴锄擨匥埸毓轥娊舯霃凘啁欕" /random /add
      4⤵
      PID:5836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "娻緙祇嵞诊郁跟嗮悼蔋鹾鎀鼧" /random /add
  2⤵
  PID:5780
- - C:\Windows\system32\net.exe
    net user "娻緙祇嵞诊郁跟嗮悼蔋鹾鎀鼧" /random /add
    3⤵
    PID:4212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "娻緙祇嵞诊郁跟嗮悼蔋鹾鎀鼧" /random /add
      4⤵
      PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "些芴箝鉚梿岏鍊鮈質馟幫鸳貓" /random /add
  2⤵
  PID:3204
- - C:\Windows\system32\net.exe
    net user "些芴箝鉚梿岏鍊鮈質馟幫鸳貓" /random /add
    3⤵
    PID:5764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "些芴箝鉚梿岏鍊鮈質馟幫鸳貓" /random /add
      4⤵
      PID:4424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "母箆搬檽硤鷯蟞嚶譂燧歔鞮誇" /random /add
  2⤵
  PID:1788
- - C:\Windows\system32\net.exe
    net user "母箆搬檽硤鷯蟞嚶譂燧歔鞮誇" /random /add
    3⤵
    PID:1140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "母箆搬檽硤鷯蟞嚶譂燧歔鞮誇" /random /add
      4⤵
      PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "溝攊廿祒餭煗詅翤缄嘴凰靕釫" /random /add
  2⤵
  PID:4292
- - C:\Windows\system32\net.exe
    net user "溝攊廿祒餭煗詅翤缄嘴凰靕釫" /random /add
    3⤵
    PID:4688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "溝攊廿祒餭煗詅翤缄嘴凰靕釫" /random /add
      4⤵
      PID:5236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "縜焆閱郼酩缠郞稏诞姖曁玌霒" /random /add
  2⤵
  PID:1132
- - C:\Windows\system32\net.exe
    net user "縜焆閱郼酩缠郞稏诞姖曁玌霒" /random /add
    3⤵
    PID:5700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "縜焆閱郼酩缠郞稏诞姖曁玌霒" /random /add
      4⤵
      PID:5896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蹜锝凔軿彊循椝鎪夣龎饨退賐" /random /add
  2⤵
  PID:4916
- - C:\Windows\system32\net.exe
    net user "蹜锝凔軿彊循椝鎪夣龎饨退賐" /random /add
    3⤵
    PID:1576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蹜锝凔軿彊循椝鎪夣龎饨退賐" /random /add
      4⤵
      PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "甇霄黈鮚綫髼庩饓锤邷硖堷愪" /random /add
  2⤵
  PID:1028
- - C:\Windows\system32\net.exe
    net user "甇霄黈鮚綫髼庩饓锤邷硖堷愪" /random /add
    3⤵
    PID:748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "甇霄黈鮚綫髼庩饓锤邷硖堷愪" /random /add
      4⤵
      PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "瀚賮尺髲舗躯璊刘裹呗鞨纲绍" /random /add
  2⤵
  PID:6032
- - C:\Windows\system32\net.exe
    net user "瀚賮尺髲舗躯璊刘裹呗鞨纲绍" /random /add
    3⤵
    PID:5752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "瀚賮尺髲舗躯璊刘裹呗鞨纲绍" /random /add
      4⤵
      PID:3912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "嵷屻矰凘露焤輞艚溪伓抻繀鶃" /random /add
  2⤵
  PID:3336
- - C:\Windows\system32\net.exe
    net user "嵷屻矰凘露焤輞艚溪伓抻繀鶃" /random /add
    3⤵
    PID:2680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "嵷屻矰凘露焤輞艚溪伓抻繀鶃" /random /add
      4⤵
      PID:5648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "枖臋贮瘔墢蓺芴梯磝兦鸳裟汢" /random /add
  2⤵
  PID:6000
- - C:\Windows\system32\net.exe
    net user "枖臋贮瘔墢蓺芴梯磝兦鸳裟汢" /random /add
    3⤵
    PID:5200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "枖臋贮瘔墢蓺芴梯磝兦鸳裟汢" /random /add
      4⤵
      PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "玾棼澽鐄訙祉霁惺帿賨睤拢縍" /random /add
  2⤵
  PID:2516
- - C:\Windows\system32\net.exe
    net user "玾棼澽鐄訙祉霁惺帿賨睤拢縍" /random /add
    3⤵
    PID:4100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "玾棼澽鐄訙祉霁惺帿賨睤拢縍" /random /add
      4⤵
      PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "渡鈏雉窳繹鑉澑骋兹快氻鉠怋" /random /add
  2⤵
  PID:4484
- - C:\Windows\system32\net.exe
    net user "渡鈏雉窳繹鑉澑骋兹快氻鉠怋" /random /add
    3⤵
    PID:3624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "渡鈏雉窳繹鑉澑骋兹快氻鉠怋" /random /add
      4⤵
      PID:528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鿊鏭渹薜觋蒣拂諙頙麓灆郏塀" /random /add
  2⤵
  PID:4568
- - C:\Windows\system32\net.exe
    net user "鿊鏭渹薜觋蒣拂諙頙麓灆郏塀" /random /add
    3⤵
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鿊鏭渹薜觋蒣拂諙頙麓灆郏塀" /random /add
      4⤵
      PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "嚏渐衺圍槞鷵糥輨赐曡斪伊朵" /random /add
  2⤵
  PID:2780
- - C:\Windows\system32\net.exe
    net user "嚏渐衺圍槞鷵糥輨赐曡斪伊朵" /random /add
    3⤵
    PID:5996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "嚏渐衺圍槞鷵糥輨赐曡斪伊朵" /random /add
      4⤵
      PID:468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "戽鐢燎邦瘄蓅浇箌跪蕝縶棸嬊" /random /add
  2⤵
  PID:4408
- - C:\Windows\system32\net.exe
    net user "戽鐢燎邦瘄蓅浇箌跪蕝縶棸嬊" /random /add
    3⤵
    PID:5260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "戽鐢燎邦瘄蓅浇箌跪蕝縶棸嬊" /random /add
      4⤵
      PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "甄哞曏頚租橖抇啃賈菭骸残鉦" /random /add
  2⤵
  PID:560
- - C:\Windows\system32\net.exe
    net user "甄哞曏頚租橖抇啃賈菭骸残鉦" /random /add
    3⤵
    PID:1336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "甄哞曏頚租橖抇啃賈菭骸残鉦" /random /add
      4⤵
      PID:3912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鿣領埴渻慗宗蚳韺奀踭螗牼厧" /random /add
  2⤵
  PID:5296
- - C:\Windows\system32\net.exe
    net user "鿣領埴渻慗宗蚳韺奀踭螗牼厧" /random /add
    3⤵
    PID:4116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鿣領埴渻慗宗蚳韺奀踭螗牼厧" /random /add
      4⤵
      PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1292
  2⤵
  - Program crash
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

椁脩堯鴞.exe

Path C:\Users\Public\Desktop\椁脩堯鴞.exe
Size 4B
SHA256 b72f53758d812fbcaef2f5bf9906f627ee6d5d5775ebf1dd62a9a10f7edd8359
MD5 7cee495091e11ff9560d3d0165133322
SHA1 e5c37d372367c69dcd30fe688631a1b0ce49ea73
SHA512 c7af91225f2bca6b06a406f24c461461ac44e4256544a258b1f1fc7d0121f55b16a0ba188e0880644756abf12a7eb8b53b80089629285521235d3402ccd65e1a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads