Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 09:33
General
- Target 8984007e5ecb5454c3a90e0a4128bf6ac0759c575afefb968358a7ecff09aa9b.exe
- Size 520KB
- Sample260903-ljfzzaem6x
- SHA256 8984007e5ecb5454c3a90e0a4128bf6ac0759c575afefb968358a7ecff09aa9b
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 47 IoCs
- Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Adds Run key to start application 2 TTPs 14 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8984007e5ecb5454c3a90e0a4128bf6ac0759c575afefb968358a7ecff09aa9b.exe"C:\Users\Admin\AppData\Local\Temp\8984007e5ecb5454c3a90e0a4128bf6ac0759c575afefb968358a7ecff09aa9b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOAXVA.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VSPUPWLMELMUQQF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QNMQDHDBRXPGFID" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NBEPRMKMCQXGRWH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HXYVEEPWMKOJRFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KTPKTFUEUVSBMTX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MROCOWCUYTPQDJQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe" /f8⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGOFDP.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HFJEMAYCUSBBVKY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJWSBVXLPVBCIAF\service.exe" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJWSBVXLPVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJWSBVXLPVBCIAF\service.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVIOTE.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNFWOKFVPAQPQN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe" /f10⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRCVV.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NSOCOAXCUYUQREJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VCVFRQRNLSNDQYH\service.exe" /f11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VCVFRQRNLSNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCVFRQRNLSNDQYH\service.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXEFC.bat" "11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IVCLVTDYKEYFVOR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe" /f12⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVMJN.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ABVSNAWHXCHWXUD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVIQH.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "THKGEVTJJLGCDNJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIQHF.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KCSCKTPKFEUVSBB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSCKTPKFEUVSBB\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTXKOO.bat" "17⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMWQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWMWQORCHMLT\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXATT.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempASWRN.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLS.bat" "22⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "23⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RISOJSETDTURALS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe" /f24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOHKLU.bat" "24⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OGWGNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWGNCBCXDTOBJD\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "25⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe26⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGCDMI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JITQPTGKGEUSJJL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVBTXS.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VJKGEGWJRALQBNY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLVDXNSXDECKCHW\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDXNSXDECKCHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDXNSXDECKCHW\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNWNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNWNSKSGQH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UUHJECFUIPKOLXT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXODM.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFGCAHCXSGN\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIFJE.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exeC:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRPRHU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YOPMVHNSECGBJUV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFKX.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFTS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CAEHSTONPFSAJAU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPVMK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHIFO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWBDTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWBDTPQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQYMN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBIWE.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSWRY.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AKXTBWYMQVCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\AKXTBWYMQVCDAJB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVKXIH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DMDVNJEXNOLUGMR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLGPGE.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WIGKFMBYCUSBCVL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VCVFRQRNLSNDQYH\service.exeC:\Users\Admin\AppData\Local\Temp\VCVFRQRNLSNDQYH\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQL.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WTSWJANJHXVMMOJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENJXW.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBTXSP.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMYUAS.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CHVVIKFDGVJQLPA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDRXQGQJIKXAXFT\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXQGQJIKXAXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDRXQGQJIKXAXFT\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHXGHQ.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAACDR.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIETHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIETHOJ\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLXIH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYDTMP.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RISOJSETDTURALS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VTSWJNJGXVLLNIB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QSICAHRHMEVMALB\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QSICAHRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QSICAHRHMEVMALB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDXWL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVKYBGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVKYBGPG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIYWFR.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWESRD.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQVOEOIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQVOEOIGJVWES\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWJMNG.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOLUG.bat" "12⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XESREMDVNJEUNOX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGPBH.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWTRVQ.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXQWI.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYXK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYXK\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSBCV.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTAXXR.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTABGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTABGDS\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHUCQ.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJIWDT.bat" "20⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DCGYXUVHNUVGAOW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe" /f21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe"C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exeC:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe21⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHF.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MSXJGLGNCDVTCDW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JCSBJSPKEETURAA\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJSPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCSBJSPKEETURAA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGXGGP.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWENEY.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEFPK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSIBYAHQGMDULAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSIBYAHQGMDULAK\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\PSIBYAHQGMDULAK\service.exeC:\Users\Admin\AppData\Local\Temp\PSIBYAHQGMDULAK\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe:*:Enabled:Windows Messanger" /f3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKIMH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exeC:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXQGQJIKXAXFT\service.exeC:\Users\Admin\AppData\Local\Temp\HDRXQGQJIKXAXFT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPXAT.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUTFN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVIQKP.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYYK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYYK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULKAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULKAU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYEWVS.bat" "9⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BMOJHKNUDPUEQBA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDYBNK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWSFC.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLHPG.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVHHBUBSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVHHBUBSOYPK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HUBKYUSCXJCWDUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXJH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUKIMH.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYITQ.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exeC:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exeC:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TYUIUGEIWXAKPWX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGHEM.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNLPK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVSS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLGDE.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CTKJTRQUHLHFVTJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJSPKEETURAA\service.exeC:\Users\Admin\AppData\Local\Temp\JCSBJSPKEETURAA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPXMM.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMRDBF.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUIIJEDJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUIIJEDJFVIPK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempURVQY.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OLLXTRVQYMOAGNN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QSICAHRHMEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QSICAHRHMEVMALB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVSS.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRRFO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYXFGP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QDLCUMIDTMNWMNK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVEQW.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exeC:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exeC:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exeC:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHXYVE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDBISINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDBISINFWNBMC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPDA.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQFPFB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSNWNC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RTJDBIRINFWNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\RTJDBIRINFWNBLC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQH.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAG.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exeC:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIKTPC.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWEYOEJBSJIS\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWEYOEJBSJIS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISN.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMIWV.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLKXE.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQML.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIPTFD.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRHSLJMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRHSLJMYCHVUG\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTOXO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLVREB.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CXBPFTOMRERTOHK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFEI.bat" "12⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OACEQRMLNDQXHSX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJJSNW.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYGHSYPNRMUIJC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVSS.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVRR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDQML.bat" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVJVGFJWYAKQXXI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRCVVK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSLBLEYDFWSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSLBLEYDFWSSA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACTPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACTPPL\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJX.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSFLQB.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRDJO.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGSQO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFFY.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GWXUDDOVLJNIQEF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMRCOW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRNOO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYUUV.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNVMG.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CQLJYOBOQLEHJSO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOXOD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFBDMI.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIQHF.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFQG\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFQG\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEGBIW.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OFEOMLPCGCAQWOE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exeC:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNVMH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ANJYWMWQOQCGMYL\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJYWMWQOQCGMYL\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNXSA.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHRN.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTKJUR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exeC:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exeC:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPGBK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exeC:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYTSAYUKXAF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exeC:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exeC:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOUQGTBK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGOFD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGKBM\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSFERV.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WCUYTPRDJQQBVUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRYOMQ.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PXPCDYUPDYKEJXG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exeC:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HUBLYUSCXJDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXMWMI\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXMWMI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOKXXJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIPTFD.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVI.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJW.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDGRTOMOESAITYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exeC:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYAUT.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MQNBNVBTXSOQCIP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHDBDYTGOINKVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHNS.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exeC:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOSYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOSYEFCLDI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYWFFQXNLPKSGHY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVH.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QEQBAEWVSTGLSTE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOWNHB.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DRMKPCPRMFIJTPC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQMLTK.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WKAOJHYWMMOJCFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOXTA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exeC:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RQCKCULICSMNWMN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DAEHTUPNQFTBKBV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXMWMI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XUTXKAOKIYWNMPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exeC:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIVDR.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempAACDR.txt
TempABPYL.txt
TempACESA.txt
TempACQML.txt
TempAHHQM.txt
TempAHUCQ.txt
TempAJXFT.txt
TempASWRN.txt
TempBDQML.txt
TempBEFPK.txt
TempBIVDR.txt
TempBNVMG.txt
TempBNVMH.txt
TempBTXSP.txt
TempCAJXF.txt
TempCAJXF.txt
TempCFGQL.txt
TempCFGQM.txt
TempCXQWI.txt
TempDGHQM.txt
TempDGHRN.txt
TempDMIWV.txt
TempDPVMJ.txt
TempDXBMK.txt
TempDYBNK.txt
TempEDHYU.txt
TempEGBIW.txt
TempEHISN.txt
TempENJXW.txt
TempEPVMK.txt
TempEWVRR.txt
TempEWVSS.txt
TempEWVSS.txt
TempEWVSS.txt
TempEXXMV.txt
TempFBDMI.txt
TempFGPLY.txt
TempGAOXK.txt
TempGBIWE.txt
TempGCDMI.txt
TempGOFDP.txt
TempGUTFN.txt
TempGXGGP.txt
TempGYUUV.txt
TempGYXTU.txt
TempHIFOA.txt
TempHIFOA.txt
TempHIRMV.txt
TempHPGBK.txt
TempHUFEI.txt
TempHXGHQ.txt
TempHXYVE.txt
TempIACQM.txt
TempIACQM.txt
TempIKTPC.txt
TempIPTFD.txt
TempIPTFD.txt
TempIRDJO.txt
TempIRNVM.txt
TempIRNVM.txt
TempIYWFR.txt
TempJGPBH.txt
TempJGSQO.txt
TempJHLGO.txt
TempJIWDT.txt
TempJJSNW.txt
TempJLGDE.txt
TempJSNWN.txt
TempJSOWN.txt
TempJWHGK.txt
TempJWHGK.txt
TempKHQCI.txt
TempKLUQD.txt
TempKTFLQ.txt
TempKTOXO.txt
TempKTPDA.txt
TempKWHGK.txt
TempKWIGK.txt
TempKXFTS.txt
TempLGPGE.txt
TempLHQHF.txt
TempLPQVB.txt
TempLVREB.txt
TempLYITQ.txt
TempMIQHF.txt
TempMIQHF.txt
TempMJSEK.txt
TempMNXSA.txt
TempMPQVC.txt
TempMRCOW.txt
TempMRDBF.txt
TempMUGNR.txt
TempMVREB.txt
TempMYUAS.txt
TempNJXWI.txt
TempNOLUG.txt
TempNOXTA.txt
TempNVHNS.txt
TempNWSFC.txt
TempOAXVA.txt
TempOHKLU.txt
TempOKXXJ.txt
TempOMQLS.txt
TempOPXAT.txt
TempOPYUB.txt
TempOWNHB.txt
TempOXODM.txt
TempOXTAG.txt
TempOXTSH.txt
TempPPYAU.txt
TempPTOWK.txt
TempPTOWK.txt
TempPVMJN.txt
TempPXATT.txt
TempPYAUT.txt
TempPYPEN.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQBVUJ.txt
TempQMLTK.txt
TempQRCVV.txt
TempQRWDE.txt
TempQRWDE.txt
TempQRWDE.txt
TempQSXDE.txt
TempQUPXL.txt
TempQVGEI.txt
TempQWMKO.txt
TempRCVVK.txt
TempRPRHU.txt
TempRVQYM.txt
TempRYOMQ.txt
TempSDWWL.txt
TempSDWWL.txt
TempSDXWL.txt
TempSFERV.txt
TempSFLQB.txt
TempSNWNC.txt
TempSXEFC.txt
TempTAXXR.txt
TempTBPOA.txt
TempTEDHY.txt
TempTFLQC.txt
TempTFLQC.txt
TempTOWKL.txt
TempTOWKL.txt
TempTOXOD.txt
TempTXKOO.txt
TempUASWR.txt
TempUGHEM.txt
TempUKIMH.txt
TempUPXMM.txt
TempUQYPE.txt
TempURVQY.txt
TempUSBCV.txt
TempUSWRY.txt
TempVBTXS.txt
TempVGFJW.txt
TempVGFJW.txt
TempVGFJX.txt
TempVHIFO.txt
TempVHNSE.txt
TempVIOTE.txt
TempVIQKP.txt
TempVJKKT.txt
TempVJKKT.txt
TempVKXIH.txt
TempVLHPG.txt
TempVLXIH.txt
TempVQYMN.txt
TempVRRFO.txt
TempWCUYT.txt
TempWCUYT.txt
TempWENEY.txt
TempWESRD.txt
TempWFFOK.txt
TempWHFKX.txt
TempWIFJE.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIOTF.bat
TempWJMNG.txt
TempWLXJH.txt
TempWRNOO.txt
TempWSRGP.txt
TempWSRGP.txt
TempWTRVQ.txt
TempWVIQH.txt
TempWVRSS.txt
TempXDVUQ.txt
TempXGGPL.txt
TempXJHLG.txt
TempXJHLG.txt
TempXMIQH.txt
TempXNLPK.txt
TempXSSHQ.txt
TempXXMVH.txt
TempXXMVI.txt
TempYAHHQ.txt
TempYAHHQ.txt
TempYDTMP.txt
TempYEWVS.txt
TempYGOFD.txt
TempYGPGE.txt
TempYKIMH.txt
TempYLKXE.txt
TempYVEQW.txt
TempYWFFY.txt
TempYXFGP.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/984-2010-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1128-4294-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1188-4877-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1380-2812-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1580-4999-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2164-4891-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2304-1958-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2436-4782-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2768-1166-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2768-4844-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2848-4654-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3120-4044-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3236-2843-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3396-2813-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3524-2717-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-646-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-1931-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-1006-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-3769-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-1421-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-645-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-2872-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-3360-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-4140-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-4976-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-2321-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-2528-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-4697-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4284-4442-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4428-3647-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4492-4259-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4544-3744-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4788-2700-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5148-4732-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5220-4381-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5244-1966-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5356-3604-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5372-2811-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6024-2842-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6112-4319-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6184-4453-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6332-3402-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6504-3711-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6844-4898-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6872-4254-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6880-3325-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7048-4851-0x0000000000400000-0x0000000000471000-memory.dmp