Analysis
- max time kernel
18s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 16:57
General
- Target 13fa52a59e9afd9b35d0543b10091295132a31e908487d5f53a670cdf04cd28d.exe
- Size 520KB
- Sample260903-vgkd2scl5w
- SHA256 13fa52a59e9afd9b35d0543b10091295132a31e908487d5f53a670cdf04cd28d
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 47 IoCs
- Checks computer location settings 2 TTPs 24 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 29 IoCs
- Adds Run key to start application 2 TTPs 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 63 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 30 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13fa52a59e9afd9b35d0543b10091295132a31e908487d5f53a670cdf04cd28d.exe"C:\Users\Admin\AppData\Local\Temp\13fa52a59e9afd9b35d0543b10091295132a31e908487d5f53a670cdf04cd28d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDRML.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UVJVGFJXYAKQXYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVIOTE.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNFWOKFVPAPPQN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIJSO.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YAWVMCQMKYPBOQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVNUJTJ\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVNUJTJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVNUJTJ\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "REMDVNJEUNOXNOL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKDGHR.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DXVTXLBPKIXNANP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOB.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTQ.bat" "8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFHQM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVNBLC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQQFOB.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNLPK.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPAXDV.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGTSF.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MQEHDBSXQGGIDAK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVC.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exeC:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVNUJTJ\service.exeC:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVNUJTJ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMV.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UQERCBFXWSTGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOULJN.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ULAVRMVGWBGVWTD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BOKYXNXQPRDHMAL\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYXNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKYXNXQPRDHMAL\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLJNIP.bat" "5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKIQCI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFDHV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSYEF.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFDGWSTBP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHIFN.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MLYFOYWGCNHHYRU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exeC:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exeC:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FGCACXSFNHMJURP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVURR.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSHVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSHVDMDX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKBFTL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DQMPTRTFJOCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMPTRTFJOCOWNB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLGPGE.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWIGKFNBYCVTCCV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLHPG.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JBRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRBJSOJEDTURAA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYIVG.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exeC:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANUEP\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGDME.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXENWUFBMFGWPSU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFJWA.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEFBGBWRFMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEFBGBWRFMG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVSS.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFOF.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNICCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNICCRSPYKQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXXT.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "COPKILAOVEQVFRD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYXNXQPRDHMAL\service.exeC:\Users\Admin\AppData\Local\Temp\BOKYXNXQPRDHMAL\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCESAO.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHCIWE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDCGYX.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPBHMA.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MHQXIEPIJSVXIJG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exeC:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVC.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUKIMH.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSST.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f8⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe:*:Enabled:Windows Messanger" /f7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe:*:Enabled:Windows Messanger" /f8⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f8⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f8⤵
- Modifies registry key
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFCLDI.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPYPE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAGCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAGCXSFN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMU.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXODM.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWUCD.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ETURABMSXJHLGOC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJWES.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBUSBVKYAGOF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJWES.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJWVI.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIQHF.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KCSCJTPKFEUVSBB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSCJTPKFEUVSBB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDXWL.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGHEN.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MLYFOYVGCNGHXQT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWRFC.bat" "15⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCQGTPNSFSUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJABDR.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "17⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XRKPWIICWADTPQL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRKPWIICWADTPQL\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "19⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHEMFJ.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYPJD.bat" "22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCN\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNFKYA.bat" "23⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OXVFCMGHXQTUGHE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe" /f24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPYPE.bat" "24⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWEMEY.bat" "25⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVSB\service.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYUSB.bat" "26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CRSPYKQVHFJEMAX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe" /f27⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTIWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTIWENE\service.exe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDEBKC.bat" "28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWTHTEDHYUWIOVV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe" /f31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVREBQ.bat" "31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe32⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFFYOJ.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAAVBRMHBGV\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAAVBRMHBGV\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIQM.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDXDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDXDUPCJE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIV.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJASKGBULLJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJASKGBULLJRDKO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOXO.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBWPV.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IMJJURPTOWKMELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSECGY.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NADPQLJMBPWFRWG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRGPC.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWIOT.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHCYRW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHQHFQO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCOOPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCOOPKIPLAOVEQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKUPDA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVIOT\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVIOT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJRNW.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMKSEK.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RQCKBTLHCSLMVYL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MBVRMAWHXCGWXUD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYPNRM.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIGOAH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJWSBVXLPUBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJWSBVXLPUBCIAF\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUGEI.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABKYG.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exeC:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIUFEI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOGYPMGBAQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGYPMGBAQROXJP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUJJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXIGKF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBCHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBCHAE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSNWNC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WYHPDDEEAVQDKFK\service.exe"C:\Users\Admin\AppData\Local\Temp\WYHPDDEEAVQDKFK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQFTBJ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIVGFJ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVUQR.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LMHGIYLSCNSCPAX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exeC:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exeC:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWDEBJ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXCVUQ.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOAIAD.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MOEWUDXMDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\MOEWUDXMDIARIGR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWKKLGFLHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWKKLGFLHXKRB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exeC:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exeC:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLVQE.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFGD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBAEW.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSDWW.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "COTPDPAXDVURSEK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GYQMHXQBRBQROXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDEWUD.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QIYIQEDEAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYIQEDEAFAVQEL\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSSDWW.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVACSPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVACSPPL\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSIWSQAVHBVXCSL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exeC:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLTLFA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exeC:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWVIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWVIQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFFD.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYWFFQXNLPKSGHY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPRMFI.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PDOEAWVMDQMKYPB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPOWKKLGELHXKRB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWKKLGELHXKRB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNVMG.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRHUCLC\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJX.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QBDGSTOMPESAIUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSPYKQ\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSPYKQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CAEHSTPNPFSAJAU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRTYEF.bat" "15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JWDMVTEAYLEYFVO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exeC:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exeC:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUBPO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWS.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCAIB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPWMKO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVUYLBPLJXOAOQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFOKY.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJAU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUJSFE.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAEUVSB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKAKEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKAKEYCFVRSA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXJQV.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBNK.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QVRFSDBGYXTUHMT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exeC:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exeC:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOWSSH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRQFO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RISOJSDTDSTQALR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWIQH.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UHLHEVTJJLGCENJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPXIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPXIICWADTPQ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\XARKPXIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPXIICWADTPQ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUTFN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRPTOW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOSNVK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRNOOX.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JEDFVIPKPMXUASW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exeC:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYQKD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBUEQPQMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBUEQPQMKRMCQXG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJKK.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exeC:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWKKLGELHXKRB\service.exeC:\Users\Admin\AppData\Local\Temp\XPOWKKLGELHXKRB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGSYOM.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPESAI.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGUT.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCO.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWANDRNLQCPRMFJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUGEI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQMTI.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQEBPYP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVSST.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exeC:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNGKBM\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOWO.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFXWST.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exeC:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSPYKQ\service.exeC:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSPYKQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJTOC.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGDME.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIJFDKFVJQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIJFDKFVJQK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWENEY.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVKKL.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HVCLYUSCXJDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exeC:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXSRXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXSRXTJWENE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSFERV.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WCUYTPQDJQQBUUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLUQDA.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YWBOESNLQDQSNGJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exeC:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPNLPDHCARWPFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exeC:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exeC:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exeC:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exeC:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJKK.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EGBCWRFMHLIUQOS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLVREB.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CXBPFSOMRERTOHK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempABKYG.txt
TempACESA.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHIQM.txt
TempAHVDR.txt
TempAHVDR.txt
TempAHVDR.txt
TempAJXFT.txt
TempBDRML.txt
TempBFXWS.txt
TempBFXXT.txt
TempBNVMG.txt
TempBPYLK.txt
TempBYUSB.txt
TempCAJXF.txt
TempCESAO.txt
TempCFHQM.txt
TempCJWES.txt
TempCJWES.txt
TempCUYTQ.txt
TempDCGYX.txt
TempDEBKC.txt
TempDEWUD.txt
TempDGHQM.txt
TempDVUQR.txt
TempDVURR.txt
TempDWUCD.txt
TempDWWLU.txt
TempDXBNK.txt
TempEFOKY.txt
TempEHIRN.txt
TempEIJSO.txt
TempEWVSS.txt
TempEXXMU.txt
TempEXXMV.txt
TempFCLDI.txt
TempFFYOJ.txt
TempFGDME.txt
TempFGDME.txt
TempFOKYX.txt
TempFTBPO.txt
TempFXWST.txt
TempFYYNW.txt
TempGAOXK.txt
TempGAOXK.txt
TempGBWPV.txt
TempGFJWA.txt
TempGHENF.txt
TempGSYOM.txt
TempGUBPO.txt
TempGUCQP.txt
TempGUCQP.txt
TempGUTFN.txt
TempHCIWE.txt
TempHCYRW.txt
TempHEMFJ.txt
TempIACQM.txt
TempIACQM.txt
TempIGOAH.txt
TempIIRMV.txt
TempIJRNW.txt
TempIJSOB.txt
TempIJTOC.txt
TempIUFEI.txt
TempIVGFJ.txt
TempJABDR.txt
TempJSNWN.txt
TempKBFTL.txt
TempKDGHR.txt
TempKIQCI.txt
TempKLUQD.txt
TempKLVQE.txt
TempKSOWO.txt
TempKSOXO.txt
TempKTPCO.txt
TempKUPDA.txt
TempKWHGK.txt
TempKXFOF.txt
TempKYGUT.txt
TempLGPGE.txt
TempLJNIP.txt
TempLPQVC.txt
TempLPQVC.txt
TempLTLFA.txt
TempLUQDA.txt
TempLVREB.txt
TempLYGUT.txt
TempMIQHF.txt
TempMJRDK.txt
TempMKSEK.txt
TempMQMTI.txt
TempMVHNS.txt
TempMVREB.txt
TempMWRFC.txt
TempNFKYA.txt
TempNJWVI.txt
TempNVJKK.txt
TempNVJKK.txt
TempNVKKL.txt
TempNWIOT.txt
TempOAIAD.txt
TempOPYUA.txt
TempOPYUB.bat
TempOPYUB.txt
TempOSNVK.txt
TempOULJN.txt
TempOWSSH.txt
TempOXODM.txt
TempOXTAB.txt
TempOXTSH.txt
TempPAXDV.txt
TempPBHMA.txt
TempPESAI.txt
TempPRMFI.txt
TempPTOWK.txt
TempPTOWK.txt
TempPUGEI.txt
TempPUGEI.txt
TempPVLJN.txt
TempPWMKO.txt
TempPXJQV.txt
TempPXODM.txt
TempPYPEN.txt
TempQBAEW.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQBVUJ.txt
TempQFTBJ.txt
TempQQFOB.txt
TempQRWDE.txt
TempQSXDE.txt
TempQSXDE.txt
TempQUGEI.txt
TempQUGEI.txt
TempQYPJD.txt
TempQYQKD.txt
TempRMUIJ.txt
TempRMUJJ.txt
TempRNOOX.txt
TempRPTOW.txt
TempRRGPC.txt
TempRSDWW.txt
TempRSXEF.txt
TempRSYEF.txt
TempRTYEF.txt
TempRVQYM.txt
TempSDXWL.txt
TempSECGY.txt
TempSFERV.txt
TempSNWNC.txt
TempSQUPX.txt
TempSSDWW.txt
TempTEDHY.txt
TempTFDHV.txt
TempTOWKL.txt
TempTRVQY.txt
TempTRVQY.txt
TempTRVQY.txt
TempTYFFD.txt
TempTYFGD.txt
TempTYIVG.txt
TempUASWR.txt
TempUASWR.txt
TempUFEIV.txt
TempUFEIW.txt
TempUFYYN.txt
TempUFYYN.txt
TempUGMRD.txt
TempUGMRD.txt
TempUGMRD.txt
TempUJSFE.txt
TempUKIMH.txt
TempUPYPE.txt
TempUPYPE.txt
TempUQYPE.txt
TempVGFJX.txt
TempVGHEN.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHIFN.txt
TempVHNSE.txt
TempVIOTE.txt
TempVLHPG.txt
TempVQQFO.txt
TempVQQFO.txt
TempVREBQ.txt
TempVRQFO.txt
TempWDEBJ.txt
TempWEMEY.txt
TempWENEY.txt
TempWIGKF.bat
TempWIGKF.txt
TempWIGKF.txt
TempWIOTF.txt
TempWLXIH.txt
TempWSRGP.txt
TempWVRSS.txt
TempWVSST.txt
TempXAMYJ.txt
TempXCVUQ.txt
TempXDVUQ.txt
TempXGGPK.txt
TempXGGPL.txt
TempXIGKF.txt
TempXNLPK.txt
TempXWIQH.txt
TempXWSST.txt
TempYAHHQ.txt
TempYAHHQ.txt
TempYGPGE.txt
TempYGPGE.txt
TempYGTSF.txt
TempYPNRM.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/64-1810-0x0000000000400000-0x0000000000471000-memory.dmp
memory/820-1817-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1020-4132-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1020-3247-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1048-2581-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1840-4747-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1996-1899-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-1001-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-3520-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-4857-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-1003-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-3136-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-2700-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-3810-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-4534-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-2382-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-1456-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-5086-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-5053-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-4223-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2032-1911-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2280-5079-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2328-3410-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2740-4017-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2752-1664-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3080-4961-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3152-5083-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3192-3068-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3324-4434-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4076-2379-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4184-2543-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4344-4960-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4888-1477-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5040-2416-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5180-4982-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5208-3969-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5216-4943-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5248-3518-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5284-4235-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5368-2980-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5456-4861-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5508-2852-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5628-5029-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5656-3618-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5660-4236-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6048-4770-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6112-5011-0x0000000000400000-0x0000000000471000-memory.dmp