Analysis
- max time kernel
13s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 09:29
General
- Target 22a492235c19c16f688cfdefd94080dd2b588c6b37b213aefbc4eb7b07209f99.exe
- Size 521KB
- Sample260910-lfz9fatzes
- SHA256 22a492235c19c16f688cfdefd94080dd2b588c6b37b213aefbc4eb7b07209f99
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 54 IoCs
- Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 18 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a492235c19c16f688cfdefd94080dd2b588c6b37b213aefbc4eb7b07209f99.exe"C:\Users\Admin\AppData\Local\Temp\22a492235c19c16f688cfdefd94080dd2b588c6b37b213aefbc4eb7b07209f99.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDXWL.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TQEQBAYEWVRTFLS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYGHSPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIV.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACFQSNLNDRYHSXI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCPFTPNSERUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RWTHTEDHYUVIOVV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYOMQL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXM.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRCVVJ.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUKIMH.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMTXJH.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPTGKGEUSJILGCD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYK.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXHTED.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVSB\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWESRD.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWPUNDNHFHYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWPUNDNHFHYUVD\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJXWMWPOQCGLYK\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "18⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "URFRCBFXWSTGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe" /f19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRN.bat" "19⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWGSSTOMTPESAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWGSSTOMTPESAJ\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDMDX\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIM.bat" "22⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ONHQYIEPIJSWXJK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe" /f23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTGMRC.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEEYNJ.bat" "24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGAFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGAFVW\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "25⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VRFSDCGYXTUHNUU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe" /f26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKUOMPAFKYXJ\service.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBHVD.bat" "27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exeC:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exe28⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYGHSPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHTQP.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LJNIQEFYWFFYOKS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJASKGBUKLJRDKO\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMMOJC.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MBLBWTSWKANJHXW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TCDOULJNIQEFYWF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEFPL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIWWWC.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTXYKK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUII.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WXUDDPVLJNIQFGY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBCLHV.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UBTEQPQMKRMCPXG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTEQPQMKRMCPXG\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHYGHQ.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FGBACXSFMHMJURP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HUQTXVXJNTAGDSR\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTXVXJNTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTXVXJNTAGDSR\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVRFC.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCPGTPNSESUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIVUH.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "POSGJFDUSIIKFBC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRIHS\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRIHS\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEFPL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHFK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYITQO.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXTTU.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSEKP.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PBJBTKHBRLMVYLM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPL\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPL\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPL\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUT\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEOJXW.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYDTMP.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDYBNK.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIASJGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIASJGBUYKLIRDJ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKIMH.bat" "17⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LUQLUGVAFVWTCNU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNLPK.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKO\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVORSY.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "21⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDGSTOMPESAIAUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe" /f22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe22⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFXWST.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBHVD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYUASW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXYMRWDEBJC\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXYMRWDEBJC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFJWA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXIBCQ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPPWLKLHFMHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPPWLKLHFMHXKSB\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUCQPB.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TVLFDKTKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\TVLFDKTKPHYPDNE\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHQHBL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTH.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDAPXP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADEOK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXIACQ.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ITYUIVGEJWXAKQX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFSAON.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSLRDJ.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DQMPTRUFJPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMPTRUFJPCOWNB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLUGMR.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDULJAU\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPWL.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFYO.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exeC:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOVF\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENEYC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXWLU.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe"C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUIPKO.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCWAMY.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exeC:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe:*:Enabled:Windows Messanger" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRIHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRIHS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJASJGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASJGBUYKLIRDJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJX.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSFLQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIQM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUPCJE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGHQL.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IXYVEFQWNLPKRGH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempECHYU.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYNSXEECKDHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYNSXEECKDHW\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUCQPB.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMEJY.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTMPQV.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGDME.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBSOYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBSOYOK\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQWC.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GUBKXTRCWJCWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIFJE.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHEMFJ.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOXOD.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJRNW.bat" "18⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKXGGSYPMQMTIJB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe" /f19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPKSH.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFHQM.bat" "21⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WUSWKAOJHYWMMOJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFWNBLC\service.exe" /f22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFWNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFWNBLC\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNUEPU.bat" "22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHTQPT.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe24⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exeC:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJKK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSAFCRR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTHOJN.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMSOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMSOERIT\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGAOW.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHCIWE.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FEPMLPCGCAQWOFF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exeC:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTP.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTPXOD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAGDSR.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTXVXJNSAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTXVXJNSAGDSR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUIPJO.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exeC:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBAYE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFMRC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFKX.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CDGSTOMPESAJAUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTABGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTABGDS\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOULJN.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exeC:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVKXIH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKYAFO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGAOX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSJHS.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUEPUE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFNF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYWFG.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXUASW.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GVVIKFDFVJQKPAM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWDDBJC\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWDDBJC\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWDDBJC\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTRUFKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTRUFKPCOWOB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGPL.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WTSWJANJHXVMMOJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTDOTD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRSOMTOESIT\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRSOMTOESIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIFOAG.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPL\service.exeC:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOESAI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXAF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQALRW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQJCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQJCIPYABOULTIS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVREBQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBGNXNSKSGRHD\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBGNXNSKSGRHD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCVVKT.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWDDBJC\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWDDBJC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFS.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYPEN.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MJJURPTOWKLELLU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSMAHC\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSMAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSMAHC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUTJTNLNDIWVIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUTJTNLNDIWVIQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVCDAI.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXTRBWICWYDTMPQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWLVLH\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFGO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABVBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFVEMAABVBSNAHC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRQFO.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JNKKWSQUPXLNFMM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMJ.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MABVSNAWHXCHWXU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINBMV\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINBMV\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINBMV\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exeC:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAVOUG.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WXAKPWXIACQMLYF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exeC:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exeC:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYNW.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYXFGP.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HWXUDEPVMKOJRFG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exeC:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSMAHC\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSMAHC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVKKL.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exeC:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exeC:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BEPRMKMCQXGRWHT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWTHTEDHYUWIOVV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WPIOVGHAUBROYOK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWTCOU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXGGSYPNRMTIJBI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVCCAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVCCAIB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDMIW.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HSQOTGKFDUSIIKF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIWDMDX\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIWDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIWDMDX\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTQ.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XKMHFIXLSBNRCOW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exeC:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXODMX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTMPQV.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHSQO.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LJNIPEFXVEFYNJS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exeC:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBTXSO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exeC:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLGCD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XVTXLBPKIXNANPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CYXBOESOMRDQSNG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGWJQA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OQLJMBPWFRVGSDC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exeC:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IWDMVTEAYLEYFVO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAACER.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AVWKWHGKXBLRYYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFWNBLC\service.exeC:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFWNBLC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVSSS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLCGUM.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GBQVOEEGBIWESRD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exeC:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe4⤵
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JYWFGRXOMQLTHIA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSPXJQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYHQGLDULKAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYHQGLDULKAU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACLHV.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVCDAJ.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXTRBWICWYDTMPQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJTPCO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYQEOF\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYQEOF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACDRN.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WKWHGKXYBLRYYJA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exeC:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHADEO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVRS.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXGCQVGHENFKBY\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFDHV.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OBEQRMKNCQXHSXH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exeC:\Users\Admin\AppData\Local\Temp\AIASJGAUYKLIRDJ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGOF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYL\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYL\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HXYVEEPWMKOJRFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQYL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJR.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYQFN.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIWDMDX\service.exeC:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIWDMDX\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGPBH.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PNMQDHDBRXPGFHC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJACDR.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSISMKNDIWVHP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exeC:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLRWIG.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XJRISOJSDTDSTQA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exeC:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exeC:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exeC:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TPDQBYEWVRSFLSS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHUCQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exeC:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exeC:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exeC:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVUHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDLF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDLF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEABKY.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GRONREIECSYQHHJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBIWE.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OFDOMKPCGCQWOEE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUKXAF\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUKXAF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHXKRB.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OSXEFCLDIWWKLGE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWYDTM.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LVLHGTAKXTRBWIC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQH.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BNTYJHLGOCEWUDD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJXWI.bat" "9⤵
- Executes a command shell one-liner
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exeC:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLT.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESNQUSVGLQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ESNQUSVGLQDAPXO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempONHCY.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exeC:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAD\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUKXAF\service.exeC:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUKXAF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempROXJP.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VUHPGYQMHXQBRBQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMDNGEHXTUC\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHWKRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WTSWJNJHXVMLOJC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGHEN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exeC:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYBGPG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFGD.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRN.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempAACER.txt
TempABPYL.txt
TempACDRN.txt
TempACLHV.txt
TempACQYL.txt
TempADEOK.txt
TempAGDSR.txt
TempAHHQM.txt
TempAHIQM.txt
TempAHUCQ.txt
TempAJXFT.txt
TempAVOUG.txt
TempBCLHV.txt
TempBDMIW.txt
TempBEFPL.bat
TempBPYLK.txt
TempBTXSO.txt
TempCAJXF.txt
TempCFGPL.txt
TempCFHQM.txt
TempCJXFS.txt
TempCUYTP.txt
TempCUYTQ.txt
TempCVVKT.txt
TempCWAMY.txt
TempDGHQM.txt
TempDGIRN.txt
TempDGIRN.txt
TempDMEJY.txt
TempDPVMJ.txt
TempDPVMK.txt
TempDWWLU.txt
TempDXWLU.txt
TempDYBNK.txt
TempEABKY.txt
TempECHYU.txt
TempEDHYU.txt
TempEDHYU.txt
TempEEYNJ.txt
TempEHIRN.bat
TempENEYC.txt
TempEOJXW.txt
TempEWVRS.txt
TempEXXMV.txt
TempEYXMV.txt
TempFGDME.txt
TempFGPLY.txt
TempFOKYX.txt
TempFSAON.txt
TempFTBPO.txt
TempFXWST.txt
TempFYNJR.txt
TempFYOJS.txt
TempFYYNW.txt
TempGAOXK.txt
TempGAOXK.txt
TempGAOXK.txt
TempGBHVD.txt
TempGBHVD.txt
TempGBIWE.txt
TempGFJWA.txt
TempGHENF.txt
TempGUCQP.txt
TempGWJQA.txt
TempGYWFG.txt
TempGYXTU.txt
TempGYXTU.txt
TempHADEO.txt
TempHCIWE.txt
TempHEMFJ.txt
TempHIFOA.txt
TempHIRMV.txt
TempHPBIM.txt
TempHQHBL.txt
TempHTQPT.txt
TempHUFDI.txt
TempHUFDI.txt
TempHXKRB.txt
TempHYGHQ.txt
TempIFOAG.txt
TempIJRNW.txt
TempIWWWC.txt
TempJACDR.txt
TempJBDRN.txt
TempJBDRN.txt
TempJGPBH.txt
TempJHLGO.txt
TempJHSQO.txt
TempJHTQP.txt
TempJLGCD.txt
TempJLUQD.txt
TempJSEKP.txt
TempJSJHS.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSOWN.txt
TempJTPCO.txt
TempJWHFK.txt
TempJXFNF.txt
TempKLUQD.txt
TempKLUQD.txt
TempKTFLQ.txt
TempKTPCO.txt
TempKYGOF.txt
TempLCGUM.txt
TempLHVUG.txt
TempLHVUG.txt
TempLPKSH.txt
TempLRWIG.txt
TempLUGMR.txt
TempMHQHF.txt
TempMIVUH.txt
TempMIWVH.txt
TempMJSEK.txt
TempMJSEK.txt
TempMMOJC.txt
TempMPQVC.txt
TempMPQVC.txt
TempMPQVC.txt
TempMPQVC.txt
TempMPQWC.txt
TempMQLTH.txt
TempMTXJH.txt
TempMUGNR.txt
TempMVHNS.txt
TempMVREB.txt
TempMVRFC.txt
TempNJXWI.txt
TempNLPKS.txt
TempNUEPU.txt
TempNVHOS.txt
TempNVJKK.txt
TempOESAI.txt
TempOJXWI.txt
TempOMQLT.txt
TempONHCY.txt
TempOULJN.txt
TempOVKKL.txt
TempOXTAB.txt
TempOXTSH.txt
TempPTOWK.txt
TempPUGEI.txt
TempPVLJN.txt
TempQALRW.txt
TempQBAYE.txt
TempQBUUJ.txt
TempQRWDE.txt
TempQSXDE.txt
TempQUPWL.txt
TempQUPXM.txt
TempQVGEI.txt
TempQWMKO.txt
TempQYPEN.txt
TempQYQFN.txt
TempRCVVJ.txt
TempRMUII.txt
TempROXJP.txt
TempRSXEF.txt
TempRSXEF.txt
TempSDXWL.txt
TempSLRDJ.txt
TempSPXJQ.txt
TempTDOTD.txt
TempTEDHY.txt
TempTFDHV.txt
TempTFMRC.txt
TempTGMRC.txt
TempTHOJN.txt
TempTMPQV.txt
TempTMPQV.txt
TempTOWKL.txt
TempTOXOD.txt
TempTPXOD.txt
TempTRVQY.txt
TempTXYKK.txt
TempTYFGD.txt
TempTYKIM.txt
TempUCQPB.bat
TempUEPUE.txt
TempUFEIV.txt
TempUFEIW.txt
TempUFEIW.txt
TempUFYNW.txt
TempUGEIW.txt
TempUGHEN.txt
TempUGMRC.txt
TempUIPJO.txt
TempUIPKO.txt
TempUKIMH.txt
TempUQYPE.txt
TempVCDAI.txt
TempVCDAJ.txt
TempVGAOW.txt
TempVGAOX.txt
TempVGFJX.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJX.txt
TempVKXIH.txt
TempVORSY.txt
TempVREBQ.txt
TempVRQFO.txt
TempWCUYT.txt
TempWESRD.txt
TempWFFOK.txt
TempWFFOK.txt
TempWFFYO.txt
TempWHFKX.txt
TempWIFJE.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIOTF.txt
TempWLXIH.txt
TempWTCOU.txt
TempWVSSS.txt
TempWYDTM.txt
TempXAMYJ.txt
TempXAMYK.txt
TempXDVUQ.txt
TempXGGPK.txt
TempXGGPL.txt
TempXHTED.txt
TempXIACQ.txt
TempXIBCQ.txt
TempXMIQH.txt
TempXNIRI.txt
TempXNLPK.txt
TempXODMX.txt
TempXSSHQ.txt
TempXUASW.txt
TempXXTTU.txt
TempYDTMP.txt
TempYFGDM.txt
TempYFGDM.txt
TempYGHQL.txt
TempYGPGE.txt
TempYITQO.txt
TempYKIMH.txt
TempYOMQL.txt
TempYUASW.txt
TempYWFGO.txt
TempYXFGP.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
memory/836-2675-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1388-3522-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1400-4447-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1500-3520-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1512-5122-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1636-5310-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1676-5622-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1852-5123-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-1965-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-3716-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-5062-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-4010-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-967-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-2447-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-2953-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-5205-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-968-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-3338-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-5519-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-4421-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-1476-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1948-5796-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2080-1668-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2880-4284-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3464-2780-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3552-3361-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4036-5606-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4084-5426-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4408-4199-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4812-2729-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4840-4570-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4948-4240-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4980-1509-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5176-3009-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5444-3481-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5488-1945-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5544-2221-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5620-2242-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5652-4584-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5676-5107-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5700-3792-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5748-2426-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5796-3494-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5880-2986-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6084-5559-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6476-5721-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6616-5752-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6628-4710-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6656-4958-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6660-5697-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6792-4933-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6904-4728-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7084-5241-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7164-5458-0x0000000000400000-0x0000000000471000-memory.dmp