Analysis
- max time kernel
12s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 12:00
General
- Target 3014b8943d1877007bdd631197b21d0344c18952e017e0aca684abaf6ba5e1e9.exe
- Size 520KB
- Sample260910-n6askswvgt
- SHA256 3014b8943d1877007bdd631197b21d0344c18952e017e0aca684abaf6ba5e1e9
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 61 IoCs
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Adds Run key to start application 2 TTPs 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3014b8943d1877007bdd631197b21d0344c18952e017e0aca684abaf6ba5e1e9.exe"C:\Users\Admin\AppData\Local\Temp\3014b8943d1877007bdd631197b21d0344c18952e017e0aca684abaf6ba5e1e9.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFGEM.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LKXENXUFBMFGWPT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SRVIMIGWULKMHAE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVOPYO.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ILXAYGTTFNEWOKF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYWFFQXNLPKSGHY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIN.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ONHQYIEPIJTWXJK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSFLQ.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RQCKCTLHCSMNWMN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQLEHJ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRGUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQOVRGUCLC\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXUU.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPCINAD\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENEWNKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\ENEWNKFYOPMVHNS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYITQO.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRQFO.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSHGHDBIDYTGO\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSHGHDBIDYTGO\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\TLKSHGHDBIDYTGO\service.exeC:\Users\Admin\AppData\Local\Temp\TLKSHGHDBIDYTGO\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GTAJXTRBWIBVYCT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIRI.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BNTYKHLGODEWUDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQKFAFUVSB\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSTQLR.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EJXWIQIROIYSDTD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXUEPV.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWCDBJC\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCWYMRWCDBJC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMFJYA\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYDVV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSEKP\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJS.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LEUDLAUARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LEUDLAUARMGBGVW\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TYUIUGEIWXAKPWX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQE.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRGQG\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTI.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFOKY.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exeC:\Users\Admin\AppData\Local\Temp\PSHBYAHQGLDULKA\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDEWUD.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AFUVSBBNTYKHLGO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVC.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GTAJXTRBWIBVXCS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VVIKFDGVJQLPAMY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWIQI.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UHLHFVTKJLGDENJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYAT.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYNW.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TATDPOPLJQLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TATDPOPLJQLBOWF\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREC.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe9⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe:*:Enabled:Windows Messanger" /f10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe:*:Enabled:Windows Messanger" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f11⤵
- Modifies registry key
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exeC:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPOAJ.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVI.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QEQCAEXWSTGLSTE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IVRAUYWKOUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRAUYWKOUABHET\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDL.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FBBWRFMGLITQOSN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMYVAS.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OKLWTRVQYMNAGNN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVKKL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENAWV.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLBMFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLBMFDGWSTBP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTP.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XKMHFHXLSBNRCOW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFFDLEIX\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFFDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFFDLEIX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDCGYX.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEWNKEYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEWNKEYOPMVHNS\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMDULAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMDULAK\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWXFT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HWXUDEPVMKOJRFG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "15⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IXYVEEQWNKOJRGH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIUFEI.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "18⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WAXLXIHLYCMSKBB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe" /f19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "20⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "21⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOFKCTKIT\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "22⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLOPUB.bat" "24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FTAJWSQAVHBVXCS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe" /f25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exeC:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe25⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCWV.bat" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNSPDPAXDVUQREK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXLSBN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCXRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCXRFMH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNTFBL.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYBUUJ.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCGHQM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exeC:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOC.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AWVMDQMKYPBPRMF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAMUMG.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDINAMU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQPTGK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCINB.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCLDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCLDIW\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGDME.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXENWUFBMFGWPST" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYPK\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYPK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSF.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exeC:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGUTF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWTRVQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLDTLJUS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRQFO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIDYTHO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RPUHLGEVTJJLGCE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJGLG.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exeC:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEXOPMUGNR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJQKP.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYTRAA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFNE.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QUGEIDLWBYTRAAU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIRDJ.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMDULAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMDULAK\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFS.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPNLPDGCARWPFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAOVEQ.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBK\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPILMW.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYIUUVQPVRHUCLC\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISN.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVUYMCPLJYOBOQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYXK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYXK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKHLG.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYTRA.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCQPBK.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KJNBEAOUNDDFAHU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJEACL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exeC:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFGOK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBSMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBSMAHCG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVLJN.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exeC:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIYLTC.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SKKRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKKRGFGCAHCXSFN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAYOTYEFDLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAYOTYEFDLDI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVURR.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YMNIGJMTCOTDPBY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMTXJH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUJIJEDJFVIQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUJIJEDJFVIQK\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRCONOKIPKANVEP\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWXUDP.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRDLC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exeC:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exeC:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFFSV.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWIICVACTPQL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRJPWIICVACTPQL\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVBCIA.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTXVYJNTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTXVYJNTAGDSR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMEJY.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGSYOM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WXUDDOVLJNIQEGY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOSNVJ.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDHW\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUYKIM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLNWSF.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IDYDQGUPNSFSUPI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WPJCHOXAAOTLTHR\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJCHOXAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJCHOXAAOTLTHR\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQE.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CYXBOFSOMRDRTOH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTPCOW.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIQEOFA\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIQEOFA\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLLFDK.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCQPBK.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJIS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJIS\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIQIC.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LHFVTKJMHADENJX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXUU.bat" "17⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PQLJMBPWFRWGSEC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIETXJKHQCINAD\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHQCINAD\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "20⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WXUDDPVLJNIQEGY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe" /f21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "21⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJABDR.bat" "22⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AUVJWHGKXYBLRYY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe" /f23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exeC:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe24⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exeC:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIVGFJ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exeC:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exeC:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYFOF.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exeC:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFFDLEIX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAOTYFFDLEIX\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSBCV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGCIWE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYPK\service.exeC:\Users\Admin\AppData\Local\Temp\WQIOVHHAUBSOYPK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVIOT\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVIOT\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIRIF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFKX.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXDEB.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYQYMWNI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYQYMWNI\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exeC:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENXFBQUGHENFKYA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exeC:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJS.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exeC:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exeC:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FGCACXSGNHMJURP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempULIMH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKIMHP.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exeC:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exeC:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJXWJ.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QUILHFVUKKMHADE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHJSO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHYPDNE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIJSO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TVLFDKUKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\TVLFDKUKPHYPDNE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WAXLXIHLYCMSKBB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXIGKF.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVOMPAFKYXJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOLTG.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMMTIHIECJEUHPJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVDRQC.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQRWC.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWNLPK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMPSRTFJOCNWNB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXJPU.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UGOGYPMHWQBRBQR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQROWIP\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQROWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQROWIP\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQROWIP\service.exeC:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQROWIP\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXATT.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBOO.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WAXLXJHLCNSLBBD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIQM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSELP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exeC:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUT\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAT.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LQMANYVBTXSOPCI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exeC:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exeC:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exeC:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exeC:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFGO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFVEMAABVBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFVEMAABVBSNAHC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPEWVDXNDIARIHR\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEWVDXNDIARIHR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWS.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWVRR.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exeC:\Users\Admin\AppData\Local\Temp\EOXFCQUGHENFKYA\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exeC:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exeC:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exeC:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exeC:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exeC:\Users\Admin\AppData\Local\Temp\TMFLSDERXOWLVLH\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPJCHOXAAOTLTHR\service.exeC:\Users\Admin\AppData\Local\Temp\WPJCHOXAAOTLTHR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXIBCQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exeC:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exeC:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCAEH.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CUMIDTMNWMNKTFL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOXO.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GLYHHTQNRMUJKCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUSBB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVLRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVLRJRFPG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ECGBJUWRPSHVDLC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOT\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOT\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOT\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUOMOAEJXWJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUOMOAEJXWJ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUOMOAEJXWJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHVUKUOMOAEJXWJ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ECGBJUWRPSHVDLC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXBUSB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exeC:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exeC:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGCDMI.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JISQPTGKGEUSJIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAACDR.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFOF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBUUJS.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RNBOWCUYTPQDJQQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCESAO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGOF.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RWHFJEMAXCUSBBV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJMNXS.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HJVVWRQWSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HJVVWRQWSIVDMDX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWIOT.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFOFXPLGWPAQAPQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADESA.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BVAWKXIHLYCMSKB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIGSPO.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KIMHPDEXVEEXNJR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FPNMQDHDARXPFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KMYYCUTBVLYBGPG\service.exe" /f14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exeC:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFJWA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exeC:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exeC:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXODM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exeC:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHQCINAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHQCINAD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempULJNI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exeC:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQYNN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTGFTW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWNVKUKG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGPBH.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"C:\Users\Admin\AppData\Local\Temp\BTMRYKAKEYCFVRS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMRCAE.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXWJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHEMFJ.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XENXVFBMFGWPTUG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWESRD.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PRHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PRHBXGPGLDULJAU\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\PRHBXGPGLDULJAU\service.exeC:\Users\Admin\AppData\Local\Temp\PRHBXGPGLDULJAU\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOT\service.exeC:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQYH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJKK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exeC:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exeC:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKUQDA.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YWAOESNLQDQSNGJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exeC:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQDJ\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exeC:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYEWV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exeC:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exeC:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLXIH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPBJBSKGBRKLUYL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGOAHL.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NMGPXHDOHISVWIJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exeC:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exeC:\Users\Admin\AppData\Local\Temp\WQJOWHHBVCSOPLK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGDH.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXNXRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXNXRPSDINAMU\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXNXRPSDINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXNXRPSDINAMU\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTFMQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTFMQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDHIRN.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XVUYLBPLIXNANPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CYXBOESOMRDQSNG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe" /f5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exeC:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exeC:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exeC:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exeC:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempAACDR.txt
TempACESA.txt
TempACESA.txt
TempADESA.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHIQM.txt
TempAJXFT.txt
TempAMUMG.txt
TempAOVEQ.txt
TempBFXWS.txt
TempBPOAJ.txt
TempBPYLK.txt
TempBPYLK.txt
TempBUUJS.txt
TempBYDVV.txt
TempBYEWV.txt
TempBYTRA.txt
TempCAJXF.txt
TempCAJXF.txt
TempCESAO.txt
TempCGHQM.txt
TempCJXFS.txt
TempCQPBK.txt
TempCQPBK.txt
TempCUSBB.txt
TempCUYTP.txt
TempDCGYX.txt
TempDESAO.txt
TempDEWUD.txt
TempDGHQM.txt
TempDHIRN.txt
TempDMEJY.txt
TempDVURR.txt
TempDWVRR.txt
TempEFOKY.txt
TempEHIRN.txt
TempEHISN.txt
TempEHJSO.txt
TempEIJSO.txt
TempENAWV.txt
TempEYXMV.txt
TempEYXMV.txt
TempFGDME.txt
TempFOKYX.txt
TempFTBOO.txt
TempFTBPO.txt
TempFTBPO.txt
TempFYNJS.txt
TempFYNJS.txt
TempGAOXK.txt
TempGCDMI.txt
TempGCIWE.txt
TempGFJWA.txt
TempGOAHL.txt
TempGSYOM.bat
TempGUCQP.txt
TempGUCQP.txt
TempGYXTU.txt
TempGYXUU.txt
TempGYXUU.txt
TempHEMFJ.txt
TempHIFOA.txt
TempHIRMV.txt
TempHPBIM.txt
TempHPBIN.txt
TempHUFDI.txt
TempIACQM.txt
TempIGSPO.txt
TempIIRMV.txt
TempIJSOC.txt
TempIUFEI.txt
TempIVGFJ.txt
TempIYLTC.txt
TempJABDR.txt
TempJEACL.txt
TempJGPBH.txt
TempJHLGO.txt
TempJLUQD.txt
TempJMNXS.txt
TempJSNWN.txt
TempJXFNE.txt
TempKIMHP.txt
TempKLUQD.txt
TempKLUQE.txt
TempKLUQE.txt
TempKSELP.txt
TempKSFLQ.txt
TempKSOXO.txt
TempKUQDA.txt
TempKWHGK.txt
TempKXFOF.txt
TempKYFOF.txt
TempKYGOF.txt
TempKYGUT.txt
TempLHVUG.txt
TempLIRDJ.txt
TempLLFDK.txt
TempLNWSF.txt
TempLOPUB.txt
TempLPQVC.txt
TempMIRIF.txt
TempMIWVH.txt
TempMIWVH.txt
TempMJRDK.txt
TempMNWSF.bat
TempMPQVC.txt
TempMPQVC.txt
TempMQLTH.txt
TempMQLTI.txt
TempMQRWC.txt
TempMRCAE.txt
TempMTXJH.txt
TempMUGNR.txt
TempMVREB.txt
TempMVREC.txt
TempMYVAS.txt
TempNJXWI.txt
TempNJXWI.txt
TempNJXWI.txt
TempNOLTG.txt
TempNTFBL.txt
TempNVJKK.txt
TempNVKKL.txt
TempNWIOT.txt
TempOJXWJ.txt
TempOPYAT.txt
TempOPYUB.txt
TempOSNVJ.txt
TempOVLJN.txt
TempOXJPU.txt
TempOXODM.txt
TempOXTSH.txt
TempPILMW.txt
TempPPYAT.txt
TempPUGDH.txt
TempPXATT.txt
TempPYPEN.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQCAEH.txt
TempQCINB.txt
TempQLEHJ.txt
TempQPTGK.txt
TempQSXDE.txt
TempQUPXL.txt
TempQUPXL.txt
TempRMUIJ.txt
TempRRCWV.txt
TempRRDLC.txt
TempRSXEF.txt
TempSTQLR.txt
TempSXDEB.txt
TempTEDHY.bat
TempTEDHY.txt
TempTFFSV.txt
TempTGFTW.txt
TempTOWKL.txt
TempTPCOW.txt
TempTRVQY.txt
TempUASWR.txt
TempUFEIW.txt
TempUFEIW.txt
TempUFGEM.txt
TempUFYNW.txt
TempUGEIW.txt
TempUGMRD.txt
TempULIMH.txt
TempULJNI.txt
TempUSBCV.txt
TempUYKIM.txt
TempVBCIA.bat
TempVDRQC.txt
TempVHFKX.txt
TempVJKKT.txt
TempVJQKP.txt
TempVLXIH.txt
TempVOPYO.txt
TempVQQFO.txt
TempVQYNN.txt
TempVRQFO.txt
TempVRQFO.txt
TempWALYJ.txt
TempWALYJ.txt
TempWCUYT.txt
TempWESRD.txt
TempWFFOK.txt
TempWFFOK.txt
TempWFGOK.txt
TempWHFJE.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIOTF.txt
TempWIQIC.txt
TempWLXIH.txt
TempWLXIH.txt
TempWNLPK.txt
TempWRRGP.txt
TempWSRGP.txt
TempWTRVQ.txt
TempWVRSS.txt
TempWXUDP.txt
TempXAMYJ.txt
TempXAMYJ.txt
TempXAMYJ.txt
TempXBUSB.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXGGPK.txt
TempXGHPL.txt
TempXIBCQ.txt
TempXIGKF.txt
TempXJGLG.txt
TempXJHLG.txt
TempXLSBN.txt
TempXMIQI.txt
TempXMIRI.txt
TempXSSHQ.txt
TempXSSHQ.txt
TempXUEPV.txt
TempXWIQI.txt
TempXXMVI.txt
TempYAHHQ.txt
TempYBUUJ.txt
TempYFGDL.txt
TempYGUTF.txt
TempYITQO.txt
TempYKHLG.txt
TempYTRAA.txt
TempYWFGO.txt
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/492-1585-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1284-4566-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1544-2106-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2020-2568-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2248-4703-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2424-3900-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2648-2421-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2804-2438-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2956-3384-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3020-2658-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3316-2608-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3628-2437-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3680-1632-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3700-1633-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-1247-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-2212-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-4721-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-3740-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-2695-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-5339-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-3032-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-4110-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-1793-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-4402-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-5027-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-1249-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-3410-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4036-4221-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4072-4676-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4108-3704-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4168-4671-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4240-4044-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4372-4899-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4384-4226-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4668-4486-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4708-2039-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4892-4210-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5008-1882-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5064-3266-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5088-2485-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5520-3398-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5588-3953-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5696-4904-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5760-2759-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5780-3872-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5924-3572-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5932-2640-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5940-2578-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6032-4313-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6056-4051-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6284-5132-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6292-5558-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6340-5424-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6624-5479-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6664-5190-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6736-5379-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6744-5484-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6772-5203-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6784-5315-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6920-5235-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7020-5501-0x0000000000400000-0x0000000000471000-memory.dmp