Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 09:36
General
- Target 233039a02f500c7c3b04730a8305aea28178144eca6d5d6cfd00235077e2f0b2.exe
- Size 520KB
- Sample260910-lkyamstzhy
- SHA256 233039a02f500c7c3b04730a8305aea28178144eca6d5d6cfd00235077e2f0b2
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 55 IoCs
- Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 19 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 20 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\233039a02f500c7c3b04730a8305aea28178144eca6d5d6cfd00235077e2f0b2.exe"C:\Users\Admin\AppData\Local\Temp\233039a02f500c7c3b04730a8305aea28178144eca6d5d6cfd00235077e2f0b2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPESAJ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WMNKTFLQCDGSTOM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRXDE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HVCLYUSDXKDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYQXMWMI\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYQXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYQXMWMI\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFHCACXSGNHMJUR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDXUOCYJEIYWFRX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXENWUFBMFGWPST" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VTSWJNJHXVMLNIB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHFJEL.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUJXFN.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRTYEF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exeC:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe11⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe:*:Enabled:Windows Messanger" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPHNUGGATARNXOJ\service.exe:*:Enabled:Windows Messanger" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f13⤵
- Modifies registry key
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYQXMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UOGMTEFSYQXMWMI\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MABWSNAWHXCHWXU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOAGLC.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PYWHDOHIYRUWHIF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNKJNAEAOUMDDFA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNPYUA.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IVRAUYWYKOUABHE\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRAUYWYKOUABHE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAAGDS\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HUBLYUSCXJDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNGMTEFSYPXMWMI\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNGMTEFSYPXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UNGMTEFSYPXMWMI\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPOBJA.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YJIMADOTMCCEGUC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJKHQC.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YASLQXJJDXBEUQR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFSWW.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKQVH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHQNICCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHQNICCRSPYKQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RISOJSETDSTQALR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAEKYXJ\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYMV.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "URFRCBFXWTUGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOXOD.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LYHITQOSNVJKDKK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRCVVK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQPXLLMHFMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPXLLMHFMIYLSC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXNJR.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LDTDKUAQLGAFVWT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTDKUAQLGAFVWT\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXTTU.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PKILAOVEQVFRDBF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQLL.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSST.bat" "12⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NOJHKNUEPUERCAF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXUEPV.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOPLK\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJJSNW.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYGHSYPNRMUIJC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBHVD.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYTJXEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYTJXEN\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIGOAH.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGOFD.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVRR.bat" "20⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YMNIGJMTDOTDQBY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKYA\service.exe" /f21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKYA\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exeC:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe22⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNGMTEFSYPXMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UNGMTEFSYPXMWMI\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHVUH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNQRWD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFMQC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTHKL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFXOLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFXOLGAAPQNWIO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEFPL.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AVTRVJMIGXVLLNI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUGEI.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIRI.bat" "11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BNTYKHLGODEWUDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIV.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKO\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NREIEBSYQGGIDAB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJSEKP\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIJSO.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFDKUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFDKUKPHYPDOE\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPRMFJ.bat" "17⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTOESAI\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exeC:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIFJE.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEMEYB.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOGYPMGBAQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGYPMGBAQROXJP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWS.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGPBHM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRRS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKAY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKAY\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exeC:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSAONI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSELP.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJTOC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCLHVU.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYNJR.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exeC:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exeC:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWRELG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNGJLU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOJIOKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOJIOKANVEP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYLKX.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHXODND\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRHUCLC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTQ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEJX\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYNW.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXEFC.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IVCLVTDYKEYFVOR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exeC:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exeC:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPUBC.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBIWE.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUXYKL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LEUDLAVARMGBGVW\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPILMV.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKB\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKB\service.exeC:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKB\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEGPL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQHMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQHMEVMAK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGODCDYDUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGODCDYDUPCKE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHHFN.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXTRAA.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exeC:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exeC:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLVREB.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CXBPFSOMRERTOHK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWKLHFHXKSBMRBO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GTAJXTRBWICWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRDJO.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTMCMFEGXTUBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTMCMFEGXTUBP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPCIN.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYCCB.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exeC:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exeC:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWTTU.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PKILAOVEQVFRDBF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GBBWRFMGLITQOSN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFS.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPNLPDGCARWPFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENEYC.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGYPMHBBQROXJP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exeC:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQE.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CYXBOFSOMRDRTOH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SRDLCUMIDTMNWMN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CGBXQVOEOIGJVWE\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CGBXQVOEOIGJVWE\service.exe"C:\Users\Admin\AppData\Local\Temp\CGBXQVOEOIGJVWE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVKXIH.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXLU.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJXWI.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHF.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEJYXG.bat" "9⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LQDAPXOCDYUPCYK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCDGY.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBUUJS.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGTTF.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SQVIMHFWUKKMHAD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VRFRDBFYXTUHMTU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYKQV.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSKIT\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXJH.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMVHNS\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKFMBY.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exeC:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GTAJXTRBWICWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSDERXOWLVLH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMEYBN.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exeC:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGMR.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TSEMDVNJEUNOXNO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exeC:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYPEN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRLDJQCCPVNVJTJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLDJQCCPVNVJTJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVKKL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPEDEAEAVQDL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYJVUVQPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYJVUVQPVRHUCLC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHMADU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQHESWIJGPBHMAC\service.exe"C:\Users\Admin\AppData\Local\Temp\HQHESWIJGPBHMAC\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\HQHESWIJGPBHMAC\service.exeC:\Users\Admin\AppData\Local\Temp\HQHESWIJGPBHMAC\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMNKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMNKSELP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDGSTOMPESAIAUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGTTF.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exeC:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPHFQO\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exeC:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDULJAU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QDLCUMIDTMNWMNK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYAT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXUU.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CGBXQVOEOIGJVWE\service.exeC:\Users\Admin\AppData\Local\Temp\CGBXQVOEOIGJVWE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWVRS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOXGCQUGHENFKBY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXGCQUGHENFKBY\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLRWIF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQML.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exeC:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exeC:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYDWV.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exeC:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVUCD.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVHHFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVHHFNGKBM\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOBXWA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UWMGELVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UWMGELVLQIQEPFB\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\UWMGELVLQIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UWMGELVLQIQEPFB\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHDBDYTGOINKVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHET\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBDGY.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXPVHD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXUASW.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWCDBJC\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWCDBJC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDRQCL.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LKOCFBPVOEEGBIV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLTKE.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWRFC.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFVIP.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YMQVCDAJBGUUIJE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exeC:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGPG.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGHQL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXSSH.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exeC:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNTYJ.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UOGMTFFSYQYMWMI\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGELVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGELVLQIQEPFB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYTRAA.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFVEMAABWBSNAHC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFDHC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADEOJ.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JURQUILHFVUKKMH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTSEN.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QDHDBRXPGGIDAKX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRCVV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBKBVL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOAJAE.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVBTXS.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUSBB.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CSTQYLRWHFJEMAY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBJD\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBJD\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHYAHH.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIEYTHO\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exeC:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADESA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GUUHJECFUIPKOLX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNKTF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQJCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQJCIPYABOULTIS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEE.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJIOKANVEP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVLVPNQBGLYKS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQLTHI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKYA\service.exeC:\Users\Admin\AppData\Local\Temp\FOXFCQUGHENFKYA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSSHP.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFUIPK\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFUIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFUIPK\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEMFKY.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWBUYT.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUBPOB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCO.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWANDRNLQCPRNFJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exeC:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BSLRYJAKDXCEURR\service.exe"C:\Users\Admin\AppData\Local\Temp\BSLRYJAKDXCEURR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRBMSX.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exeC:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exeC:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXEUNR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exeC:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAKXFT.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QNMQDHDBRXPGGID" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWL.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYBUUJ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOHAGNWMSJRGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOHAGNWMSJRGQG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQDYCP.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UASWRNOBGNOXSSH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOLPKS.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPDAOWO\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPDAOWO\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWBUYT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJRNVN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTPXPE.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQI.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NNTYJHLGODEWUDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRINFWNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRINFWNBLC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUYMPQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWSFC.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCQGTPNSFSUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exeC:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exeC:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exeC:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGOAHL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCYQWOFPIHJWWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYQWOFPIHJWWES\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLJNIQ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFNEWOKFVOPYOPM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGPBHM.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NMHQXIEPIJSVWIJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe"C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLHPG.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFOKY.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VSRVIMIGWULKNIB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRC.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFCKD.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CLVTDYKDXEVORSX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempINKVS.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHFIYUVD\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLT.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CDYUPCYJEJYWGRX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKQDAPXO\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKQDAPXO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEJW.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVOEOHGIVWDR\service.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exeC:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLTHRH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNEWOKFVOAPYOP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVSSS.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OJHKNUDPTEQBAYE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKUPDA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQFPFB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYEWV.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSFLQ\service.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exeC:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIVDR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACWSNBXIYDHXYVE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFFY.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exeC:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exeC:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSPJEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSPJEETURAA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRQFO.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "INKKVSQUPXLMFMM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHGHDBIDYTHO\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGHDBIDYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGHDBIDYTHO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSSDWW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXPDM.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exeC:\Users\Admin\AppData\Local\Temp\SSCONOKIPKAOVEP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exeC:\Users\Admin\AppData\Local\Temp\BTLRYJAKDXCEVRR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHDBDYTGOINKVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXVEFY.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWENEY.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSUGKQDAPXO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exeC:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exeC:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNGLBM\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBJD\service.exeC:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBJD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FTORVTWHMREBQYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FTORVTWHMREBQYP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYAUT.bat" "3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exeC:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exeC:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exeC:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGHDBIDYTHO\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHGHDBIDYTHO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFKYHS.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempABPYL.txt
TempACQLL.txt
TempACQML.txt
TempADEOJ.txt
TempADESA.txt
TempAKXFT.txt
TempBEFPL.txt
TempBEGPL.txt
TempBFXWS.txt
TempBIVDR.txt
TempBKBVL.txt
TempBNTYJ.txt
TempBPYLK.txt
TempBUUJS.txt
TempBYDWV.txt
TempBYEWV.txt
TempCFVIP.txt
TempCIWES.txt
TempCJXFS.txt
TempCLHVU.txt
TempCUSBB.txt
TempCUYTQ.txt
TempCXAMY.txt
TempDESAO.txt
TempDGHQM.txt
TempDPVMK.txt
TempDRQCL.txt
TempDVUCD.txt
TempDXBMK.bat
TempEDHYU.txt
TempEFCKD.txt
TempEFOKY.txt
TempEHIRN.txt
TempEHIRN.txt
TempEIJSO.txt
TempEJYXG.txt
TempEMEYB.txt
TempEMFKY.txt
TempENEYC.txt
TempEWVRR.txt
TempEWVRS.txt
TempEXNJR.txt
TempEXXLU.txt
TempEYNJR.txt
TempEYXMV.txt
TempEYXMV.txt
TempEYXMV.txt
TempFGPLY.txt
TempFKYHS.txt
TempFOKYX.txt
TempFOKYX.txt
TempFTBPO.txt
TempFTBPO.txt
TempFTBPO.txt
TempFTSEN.txt
TempFYOJS.txt
TempFYOJS.txt
TempFYYMV.txt
TempFYYNW.txt
TempFYYNW.txt
TempFYYNW.txt
TempGAOXK.txt
TempGBHVD.txt
TempGBIWE.txt
TempGFSWW.txt
TempGOAHL.txt
TempGPBHM.txt
TempGPBHM.txt
TempGUCQP.txt
TempGYXTU.txt
TempGYXUU.txt
TempHFJEL.txt
TempHIFOA.txt
TempHMADU.txt
TempHPCIN.txt
TempHYAHH.txt
TempIGOAH.txt
TempIIRMV.txt
TempIIRMV.txt
TempIJSOC.txt
TempIJTOC.txt
TempINKVS.txt
TempIRDJO.txt
TempJBDRN.txt
TempJHLGO.txt
TempJHLGO.txt
TempJHLGO.txt
TempJJSNW.txt
TempJKHQC.txt
TempJRNVN.txt
TempJWHGK.txt
TempKFMBY.txt
TempKLUQD.txt
TempKLUQE.txt
TempKSELP.txt
TempKTFLQ.txt
TempKTPCA.txt
TempKTPCO.txt
TempKTPCO.txt
TempKUPDA.txt
TempKWIGK.txt
TempKYGUT.txt
TempKYGUT.txt
TempLHQHE.txt
TempLHQHF.txt
TempLJNIQ.txt
TempLRWIF.txt
TempLVREB.txt
TempLYCCB.txt
TempLYGPG.txt
TempMEYBN.txt
TempMHQHF.txt
TempMHQHF.txt
TempMHVUH.txt
TempMIWVH.txt
TempMIWVH.txt
TempMJRDK.txt
TempMJSEK.txt
TempMNKTF.txt
TempMPQVC.txt
TempMPQVC.txt
TempMPQVC.txt
TempMPQVC.txt
TempMUGMR.txt
TempMUGNR.txt
TempMWRFC.txt
TempMWSFC.txt
TempNGJLU.txt
TempNLPKS.txt
TempNLPKS.txt
TempNPYUA.txt
TempNQRWD.txt
TempNVHOS.txt
TempNVHOS.txt
TempOAGLC.txt
TempOAJAE.txt
TempOBXWA.txt
TempOJXWI.txt
TempOLPKS.txt
TempOMQLT.txt
TempOPUBC.txt
TempOPYAT.txt
TempOPYUB.txt
TempOVKKL.txt
TempOXSSH.txt
TempOXTAB.txt
TempOXTSH.txt
TempPESAJ.txt
TempPILMV.txt
TempPOBJA.txt
TempPPYAU.txt
TempPRMFJ.txt
TempPTHKL.txt
TempPTOWK.txt
TempPTOWL.txt
TempPVLJN.txt
TempPXODM.txt
TempPXPDM.txt
TempPYAUT.txt
TempPYKQV.txt
TempPYLKX.txt
TempQBDGY.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQCDGY.txt
TempQDYCP.txt
TempQLTHI.txt
TempQRCVV.txt
TempQRWDE.txt
TempQRXDE.txt
TempQUGEI.txt
TempQUPXL.txt
TempQUPXL.txt
TempQUPXL.txt
TempQWMKO.txt
TempQWMKO.txt
TempQYPEN.txt
TempRBMSX.txt
TempRCVVK.txt
TempRMUIJ.txt
TempRSXEE.txt
TempRTYEF.txt
TempRVQYM.txt
TempSAONI.txt
TempSQUPX.txt
TempSSDWW.txt
TempSXEFC.txt
TempTBPOA.txt
TempTFDHC.txt
TempTFLQC.txt
TempTFLQC.txt
TempTFMQC.txt
TempTOXOD.txt
TempTPXPE.txt
TempTRVQY.txt
TempUBPOB.txt
TempUFEIV.txt
TempUFYNW.txt
TempUGEIW.txt
TempUGMRC.txt
TempUJXFN.txt
TempUXYKL.txt
TempUYMPQ.txt
TempVBTXS.txt
TempVGEJW.txt
TempVGFJW.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJX.txt
TempVHHFN.txt
TempVHNSE.txt
TempVJKKT.txt
TempVKXIH.txt
TempVQQFO.txt
TempVRQFO.txt
TempWALYJ.txt
TempWBUYT.txt
TempWBUYT.txt
TempWCUYT.txt
TempWENEY.txt
TempWFFOK.txt
TempWIFJE.txt
TempWIGKF.txt
TempWIGKF.txt
TempWLHPG.txt
TempWLXJH.txt
TempWSRGP.txt
TempWSSHP.txt
TempWVRRS.txt
TempWVRSS.txt
TempWVSSS.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXEUNR.txt
TempXGHPL.txt
TempXMIQI.txt
TempXMIRI.txt
TempXPVHD.txt
TempXTRAA.txt
TempXUASW.txt
TempXUEPV.txt
TempXVEFY.txt
TempXWSST.txt
TempXWTTU.txt
TempXXMVI.txt
TempXXTTU.txt
TempYBUUJ.txt
TempYFGDM.txt
TempYFGDM.txt
TempYGHQL.txt
TempYGOFD.txt
TempYGPGE.txt
TempYGTTF.txt
TempYKQVH.txt
TempYLTKE.txt
TempYTRAA.txt
TempYWFFY.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
memory/568-3495-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1248-3740-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1548-4006-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1752-5288-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1952-5621-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2040-2554-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2272-4387-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2884-6022-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3360-4952-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3836-1923-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4120-4214-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4212-2141-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-5433-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-5797-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-2211-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-5117-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-1796-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-4452-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-3687-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-1271-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-4080-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-1270-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-2684-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-4872-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-3201-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4312-5050-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4464-3713-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4588-1826-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4620-4951-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4624-5914-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4644-1784-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4720-5278-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4880-1901-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4908-4209-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4980-1821-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5068-4485-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5100-4845-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5132-2506-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5292-1794-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5336-4660-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5344-1829-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5388-4500-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5560-3013-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5584-5906-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5688-1751-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5760-3534-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5792-3660-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5868-2567-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5924-5575-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5996-5104-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6492-5424-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6556-3739-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6692-2991-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6808-3946-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6976-3393-0x0000000000400000-0x0000000000471000-memory.dmp