Analysis
- max time kernel
150s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 09:44
General
- Target 8fc192d580514e93b68f10fec2604f81f83c05eba7c5c20ef1bc76f20667d6a9.exe
- Size 520KB
- Sample260903-lqjpfaep21
- SHA256 8fc192d580514e93b68f10fec2604f81f83c05eba7c5c20ef1bc76f20667d6a9
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 43 IoCs
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 21 IoCs
- Adds Run key to start application 2 TTPs 17 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 56 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc192d580514e93b68f10fec2604f81f83c05eba7c5c20ef1bc76f20667d6a9.exe"C:\Users\Admin\AppData\Local\Temp\8fc192d580514e93b68f10fec2604f81f83c05eba7c5c20ef1bc76f20667d6a9.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNVNH.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CQMKYPBPRMFIJSO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGOAH.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RNMGPXHDOIISVWI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXBEUQ\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXBEUQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXBEUQ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIPTFD.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OGXPLGWPBQAQROW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QUHLHFVTKJMHADE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPBHMA.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NHQXIEPIJSVXIJH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOOMUGNR\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOOMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOOMUGNR\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHVUG.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "POSGJFDTSIIKFBC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe" /f8⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFQXN.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OWOBDXTOCXJYDIY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCXQVOEOIGJVWES\service.exe" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQVOEOIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQVOEOIGJVWES\service.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQH.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BNTYJHLGOCEWUDD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe" /f10⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HYQMHXQCRBRSPXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBNV\service.exe" /f11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBNV\service.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQWC.bat" "11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GUBKXTRCWJCWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe" /f12⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYAUT.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MQNBNVBTXSOQCIP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe" /f13⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYUSA.bat" "13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CRSPYKQVHFJEMAX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe" /f14⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BVWKXIGLYCMRYKA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe" /f15⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCWV.bat" "15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "COSPDPAXDVUQSEK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVBTX.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WVJKFDGWJQALQAN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLYUDXNRWDEBKCH\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\CLYUDXNRWDEBKCH\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYNNOW.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQSIV.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempROXJP.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRLMVY.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSPYKQ.bat" "21⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IWVHPHQNHXRCSBR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe" /f22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exeC:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe22⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHDBDYTGOINKVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "URFRCBFXWSTGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFHCAJ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYSGN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOWKKL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYWFF.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWL.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHCADYTGNINJVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFTS.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFGPL.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QSICYAHRHMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\QSICYAHRHMEVMAK\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMXVU.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSTT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHLCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHLCN\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKNOHA.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exeC:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNTYKIMHPDEXVEE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LYFPYWGDNHIYRUV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJS.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TCCOULIMHPEFXVE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBOO.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXAMY.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFXOLFAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFXOLFAAPQNWIO\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVLJN.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXNYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXNYRPSDINAMU\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exeC:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNTYKIMHPDEXVEE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPMLPCGCAQWOFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXEUN.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EDHYVWIOVWHBPXK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOSNUJ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDXNSXDECKDHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDXNSXDECKDHW\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYPJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQXM.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPWMK.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MABWSNAWIXCHWXV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOHKLU.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPGEQ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVCCAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVCCAIB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJKK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBNK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKNPYU.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FESIWRPAUHAUWBR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOHLMV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKQVH.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOC.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSEBFA.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVLVPNQBGLYKS\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DFAAVQELGKYHTPN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUIIJECJFVIPK\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exeC:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXDEB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWNI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWNI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIRI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSYEF.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDL.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JWDMWUEALFGWPST" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEID.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGN\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYNW.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOPLJQLBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOPLJQLBPWF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTQ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFKX.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CKCULIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCULIDWMNKTFLQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JYWFGRXOMQLTHIB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGOGD.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROIDCSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROIDCSTQLR\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQATIW.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exeC:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQQFO.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "INJJVSQUPWLMELM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe:*:Enabled:Windows Messanger" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQM.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WUSWKANJHYWMMOJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYLKX.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVEPWM.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VMABWSNAWIXCHWX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYBUU.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESNMH.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQOQGU.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXGHSYPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNUJJK.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exeC:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exeC:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTP.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XKMHFIXLSBNRCOW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYCVTC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe"C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFHQM.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RTJDBIRINFWNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\RTJDBIRINFWNBLC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCPP.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSIWSQAVHBVXCSL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEQWMK.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJURPT.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCOOPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCOOPKIPLAOVEQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHOSE.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNFWOKFVOAPPQN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTH.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXO\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempANVEP.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPRWC.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exeC:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exeC:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWL.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUFDH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYYUU.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSFLQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exeC:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exeC:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMTCOS.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELUKQHYPEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELUKQHYPEOE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYFOF.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSTT.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VVIKFDGVJQLPAMY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYMMNW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRGOB.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exeC:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRWDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\CLYUDXNRWDEBKCH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJACDR.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYFOF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSBCV.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DSTQLRWIFKFMBYC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMUH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exeC:\Users\Admin\AppData\Local\Temp\LETDLAUARMGBGVW\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXJH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exeC:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exeC:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIGKFM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVCDAJ.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXTRCWJCWYDTMPQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJGKF.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUII.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exeC:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUSBB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYTRAA.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BRSPXKQVGEIDLWB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBBHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBBHAE\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempURVQY.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GUUIJECFVIPKPLX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAJB\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAJB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVYCTM.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXIGL.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJEXNOLUGMR\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBMVMG.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exeC:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABHES\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDKFVIQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDKFVIQK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXEFC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPVMK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUIPKP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQOQGU.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TKUQLUFVAFUVSCN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHCIWE.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIREDQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGOF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQAIRNIDCSTQYK\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQAIRNIDCSTQYK\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\IAQAIRNIDCSTQYK\service.exeC:\Users\Admin\AppData\Local\Temp\IAQAIRNIDCSTQYK\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exeC:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVC.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLJNIQ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exeC:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exeC:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSST.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJACDR.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPQNWI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSST.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exeC:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRCVV.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIBCQM.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGPBH.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ANNHQXIEPIJSVXI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLOPVB.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOWKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOWKUKG\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOWKUKG\service.exeC:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOWKUKG\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGKKEC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXFNEC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRRPXJQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRRPXJQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNQRWD.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IHUBKYUSCXJDXEU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVRS.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHTFDH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYBUU.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWIQH.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUCQPB.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NKJNAEAOUMDCFAG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABGDS.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSISMKNDIWVHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJMNG.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESNMH.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WKWHGKYBLRYKAAC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exeC:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAACDR.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAJB\service.exeC:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAJB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFNE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHPBI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRYKAKEYCFVRS\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMRYKAKEYCFVRS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXUU.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OQLJMBPWFRVGSDC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBINAD\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBINAD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIXYVF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLKXE.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "THUFEIVWJPWWHBP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOXO.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWQEL\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWQEL\service.exeC:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWQEL\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exeC:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ANJYWMWQORCGMYL\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJYWMWQORCGMYL\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOCNWN.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUDPVL.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MUMBVRMAWHXCGWX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVDQPC.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NKJNBEAPUNDDFAH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVBTXS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAPXPJ.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exeC:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIBGNWNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIBGNWNSKSGQH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFWSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFWSSA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCSLOP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKLHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKLHFMHXLSB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOTECG.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLUDXNSXDEBKCHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLUDXNSXDEBKCHW\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJKHQC.bat" "8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exeC:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOXTA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBSMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBSMAHCG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSEAKB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GUPSWUXIMSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUPSWUXIMSFCRQE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREC.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCPFTPNSESUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exeC:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSSHQ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWGSDC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exeC:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exeC:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBINAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBINAD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XLMHFIYLSCNSCPA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exeC:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFGCACXSGNHMJUR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIQCJN.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OAIRJFAQJKTXYKL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVI.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKECKTJOGXOCND\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBXWAN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exeC:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJX\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLWUSX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempAACDR.txt
TempABGDS.txt
TempABPYL.txt
TempACESA.txt
TempAHHQM.txt
TempAJXFT.txt
TempANVEP.txt
TempAPXPJ.txt
TempBFGPL.txt
TempBMVMG.txt
TempBNVNH.txt
TempBPYLK.txt
TempBPYPJ.txt
TempBXWAN.txt
TempBYUSA.txt
TempCFGQM.txt
TempCFHQM.txt
TempCIWES.txt
TempCSLOP.txt
TempCUSBB.txt
TempCUYTP.txt
TempCUYTQ.txt
TempCXAMY.txt
TempDGHQM.txt
TempDGIRN.txt
TempDHYUV.txt
TempDMXVU.txt
TempDXAMY.txt
TempDXBNK.txt
TempEHIRN.txt
TempEHISN.txt
TempEPVMK.txt
TempEPWMK.txt
TempEQWMK.txt
TempESNMH.txt
TempESNMH.txt
TempEWVRS.txt
TempEYXMV.txt
TempEYXMV.txt
TempFHCAJ.txt
TempFTBOO.txt
TempFYNJS.txt
TempFYWFF.txt
TempGKKEC.txt
TempGUCPP.txt
TempGYXUU.txt
TempGYYUU.txt
TempHCIWE.txt
TempHIFOA.txt
TempHPGEQ.txt
TempHTFDH.txt
TempIBCQM.txt
TempIGKFM.txt
TempIIRMV.txt
TempIIRMV.txt
TempIJSOC.txt
TempIPTFD.txt
TempIQCJN.txt
TempIREDQ.txt
TempIRNVM.txt
TempIRNVM.txt
TempIXYVF.txt
TempJACDR.txt
TempJACDR.txt
TempJGOAH.txt
TempJGPBH.txt
TempJHPBI.txt
TempJKHQC.txt
TempJLUQD.txt
TempJSNWN.txt
TempJSOWN.txt
TempJURPT.txt
TempJWHGK.txt
TempJXEUN.txt
TempJXFNE.txt
TempKHQCI.txt
TempKLUQD.txt
TempKNOHA.txt
TempKNPYU.txt
TempKSFLQ.txt
TempKSOXO.txt
TempKTFLQ.txt
TempKWHGK.txt
TempKXFTS.txt
TempKXIGL.txt
TempKYFOF.txt
TempKYGOF.txt
TempKYGUT.txt
TempLJNIQ.txt
TempLOPVB.txt
TempLPQVC.txt
TempLWUSX.txt
TempMHQHF.txt
TempMHVUG.txt
TempMIWVH.txt
TempMJRDK.txt
TempMJSEK.txt
TempMNWSA.txt
TempMPQWC.txt
TempMPRWC.txt
TempMQLTH.txt
TempMQLTH.txt
TempMTCOS.txt
TempMUGNR.txt
TempMVHNS.txt
TempMVREB.txt
TempMVREC.txt
TempNJXWI.txt
TempNLPKS.txt
TempNOXTA.txt
TempNQRWD.txt
TempNUJJK.txt
TempNVHOS.txt
TempNVHOS.txt
TempNVJKK.txt
TempOCNWN.txt
TempOHKLU.txt
TempOHLMV.txt
TempOPYUB.txt
TempOSNUJ.txt
TempOTECG.txt
TempOVLJN.txt
TempOWKKL.txt
TempOXTAB.txt
TempPBHMA.txt
TempPQNWI.txt
TempPTOWK.txt
TempPTOWL.txt
TempPTOWL.txt
TempPUFDH.txt
TempPYAUT.txt
TempPYLKX.txt
TempPYPEN.txt
TempQATIW.txt
TempQBVUJ.txt
TempQOQGU.txt
TempQRCVV.txt
TempQRWDE.txt
TempQUPXL.txt
TempQVGEI.txt
TempQYBUU.txt
TempQYBUU.txt
TempRLMVY.txt
TempRMUII.txt
TempRMUIJ.txt
TempROXJP.txt
TempRRCWV.txt
TempRRGOB.txt
TempRSXEF.txt
TempRSYEF.txt
TempRVQXM.txt
TempSEAKB.txt
TempSEBFA.txt
TempSPYKQ.txt
TempSQSIV.txt
TempSQUPX.txt
TempSXDEB.txt
TempSXEFC.txt
TempTBPOA.txt
TempTOWKL.txt
TempTYKIM.txt
TempTYKIM.txt
TempUASWR.txt
TempUCQPB.txt
TempUDPVL.txt
TempUFYNW.txt
TempUFYYN.txt
TempUIPKP.txt
TempUQQFO.txt
TempUQYPE.txt
TempURVQY.txt
TempUSBCV.txt
TempVBTXS.txt
TempVCDAJ.txt
TempVDQPC.txt
TempVEPWM.txt
TempVGEID.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJX.bat
TempVHFJX.txt
TempVHNSE.txt
TempVHOSE.txt
TempVJMNG.txt
TempVQQFO.txt
TempVYCTM.txt
TempWFQXN.txt
TempWGSDC.txt
TempWHFJE.txt
TempWHFKX.txt
TempWIOTF.txt
TempWLXIH.txt
TempWLXIH.txt
TempWLXJH.txt
TempWSRGP.txt
TempWSSHQ.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXFNEC.txt
TempXGGPK.txt
TempXJGKF.txt
TempXMIQH.txt
TempXMIRI.txt
TempXNIRI.txt
TempXSSHQ.txt
TempXSSHQ.txt
TempXSSHQ.txt
TempXWIQH.txt
TempXWSST.txt
TempXWSST.txt
TempXWSTT.txt
TempXWSTT.txt
TempXXMUH.txt
TempXXMVI.txt
TempYCVTC.txt
TempYFGDL.txt
TempYFGDM.txt
TempYGOGD.txt
TempYKQVH.txt
TempYLKXE.txt
TempYMMNW.txt
TempYNNOW.txt
TempYTRAA.txt
TempYVBTX.txt
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/556-4720-0x0000000000400000-0x0000000000471000-memory.dmp
memory/556-4885-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1056-2500-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1148-4513-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3088-3095-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3380-4869-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3400-4846-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3572-4522-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3748-3048-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4200-1941-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4324-4288-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4404-4291-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4456-2029-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4688-4290-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4700-2748-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4876-3936-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4932-4167-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4960-2212-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5016-1679-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5240-2470-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5344-2810-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5484-3559-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-2132-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-4387-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-4682-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-3730-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-2935-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-1052-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-4019-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-3287-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-1588-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-2422-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-1051-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-5214-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5804-5120-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6096-4123-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6128-1895-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6344-5119-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6356-4277-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6380-3525-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6468-3566-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6484-4771-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6800-4599-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6968-4480-0x0000000000400000-0x0000000000471000-memory.dmp