Analysis
- max time kernel
14s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 14:11
General
- Target 3b9b952fe6fee8ad82b1c58ea1bfa549fe59f7e8b25032a26be6293dd997c8f5.exe
- Size 520KB
- Sample260910-rhjmcsdk4z
- SHA256 3b9b952fe6fee8ad82b1c58ea1bfa549fe59f7e8b25032a26be6293dd997c8f5
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 51 IoCs
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 24 IoCs
- Adds Run key to start application 2 TTPs 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 23 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9b952fe6fee8ad82b1c58ea1bfa549fe59f7e8b25032a26be6293dd997c8f5.exe"C:\Users\Admin\AppData\Local\Temp\3b9b952fe6fee8ad82b1c58ea1bfa549fe59f7e8b25032a26be6293dd997c8f5.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKQVH.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VHQHRNIYRCSCRSP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYYUU.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PQLJMBPWFRWGSEC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWTHTEDHYUWIOVV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CAEHTUPNQFTBJBV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLEHIS.bat" "6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXAANTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXAANTLTHR\service.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWTTU.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJIS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJIS\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe11⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe:*:Enabled:Windows Messanger" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe:*:Enabled:Windows Messanger" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f13⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f12⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f13⤵
- Modifies registry key
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exeC:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQAL\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXVEE.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FVVTCCNUYKIMHPD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIXHPDCDYEUPDKE\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCDYEUPDKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCDYEUPDKE\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPYPE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HMIJURPTOWKLELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXATT.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QMAMYVASWROPCHO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBIWE.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FEOMLPCGCAQWOFE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOULIM.bat" "8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMAL\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLHFMHXKSB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVASWR.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRMV.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGODCDYEUPCKE\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLKXEU.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXATT.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAG.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUITJ\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TSEMDVNJEUNOXOP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVUQR.bat" "17⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJASJGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASJGBUYKLIRDJ\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIGOAG.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLQXJJDXBEUQR\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "20⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BEPRMKMCQXGSWHT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe" /f21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUIPKO.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "22⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUTFN.bat" "23⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QEIDBSXQGGIDBKY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe" /f24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXJJCWBDUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXJJCWBDUQR\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVYLMJ.bat" "25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMCPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMCPWG\service.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMCPWG\service.exeC:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMCPWG\service.exe26⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exeC:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHRM.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XUTXLBOKIYXNNPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIMDDB.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UVRPRHUCLCWAMYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMQWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMQWCDAJB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEGPL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQHMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQHMEVMAK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXQWH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCYXBO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHWUKUOMPAEKXXJ\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCDYEUPDKE\service.exeC:\Users\Admin\AppData\Local\Temp\PIXHPDCDYEUPDKE\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDGSTOMPESAIAUJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDHIRN.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XVUYLBPLJXOANPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHBOXK.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSTT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDRWHIGOAHLCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDRWHIGOAHLCN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHCAJX.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJWEN\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHXKRB.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MTXJHLGOCDWUDDW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGDH.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKOOHA.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\GPYHDRVHIFOAGLB\service.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exeC:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLUQDA.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJRCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJRCCQVNVJUKG\service.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFGD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVBTX.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VVJKFDGWJQALQAN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLYUCXNRWDEBKCH\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\CLYUCXNRWDEBKCH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIWES.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFO\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFO\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWRRG.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYBUU.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRM.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exeC:\Users\Admin\AppData\Local\Temp\YFXHTTUPOUQGTBK\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHPGE.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTTRAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTTRAL\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOXTA.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FERHVRPUGAUWBRK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYJHLG.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCESAO.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQGTBK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGGHCAHDYTGN\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYBUU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELHWKRA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJWSAVYXLPUBCIA\service.exe"C:\Users\Admin\AppData\Local\Temp\AJWSAVYXLPUBCIA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMKSEL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEID.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUR.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFKYA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBUEQPQMKRMCPXG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBUEQPQMKRMCPXG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIJSO.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFDKUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFDKUKPHYPDOE\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSF.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GVUIJFDFVIQKPMX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFDLD.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMEJYA\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMEJYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENXFBPUFGEMEJYA\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQL\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIRIG.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNTYKIMHPDEWVDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFYO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMAAVBRMAHBG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJTOC.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMFELUKQHYPEOE\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRPTO.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOTYEFCLDI\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJS.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACTPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACTPPL\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAT.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WONVJJKFEKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVJJKFEKGWJQA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPDA.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWANDRNLQCQSNGJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPRHVD.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYAN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWNKO.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOBNVN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERWOWKVLH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJPUFD.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPNRMU.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJJRFEFBGBWRFMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJJRFEFBGBWRFMG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTUQOVQGUBKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTUQOVQGUBKB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWUDD.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKQVH.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAIROJDDSTQLR\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHRN.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMTII.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exeC:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exeC:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUKIMH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIMDDC.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESOQUSVGLQDAPXP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYRWIE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWSFC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTKSHRH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONOKIPKAOVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONOKIPKAOVEP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LGVTJTNLOEJXWIQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQRNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQRNLSNDRYH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTGMRC.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIGJVWES\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAIDYR.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESXQGQKILXBYGU\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYUSB.bat" "9⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CRSQYKRVHFJEMAX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSYEF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTARYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUFGTARYNXNJ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBQYQK.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBQYP\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXFNEC.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UGEIDLWAYTRAATJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDOTEQ.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGCDMI.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JITQPTGKGEUSJJL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJSJD.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIETXJKHPBIMAD\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBYUSBUKXAFO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGAOW.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exeC:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUCXNRWDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\CLYUCXNRWDEBKCH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADESA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXIUTUQOVQGTBK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSHGHCBHDYTGO\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSHGHCBHDYTGO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKVSQU.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exeC:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exeC:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJTPCO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYPEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYPEOE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNXSA.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWSFC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLSHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLSHRH\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLSHRH\service.exeC:\Users\Admin\AppData\Local\Temp\WPJBHOXANTLSHRH\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYTRA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXWIQ.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exeC:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWOB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGHFN.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MLYFOYVGCNGHXQU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXMGFMVLRIQEPFB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTEQPQLKQMCPXG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTEQPQLKQMCPXG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UBTEQPQLKQMCPXG\service.exeC:\Users\Admin\AppData\Local\Temp\UBTEQPQLKQMCPXG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFFYOJ.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAAVBRMHBGV\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAAVBRMHBGV\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BEPRMKMCQXGSWHT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNLPK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYUASW.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXYMRWDEBJC\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXYMRWDEBJC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCTKIT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHQHBL.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KGEUTJJLGCDNIWV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWGNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWGNCBCXDTOBJD\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOB.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFSWW.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TSEMDVNJEUNOXOO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWT.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNPKILAOVEQUFRC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempALULF.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BOKIYWNNPKDGHQM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOWNHB.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DRMKPCPRMFIKTPC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ESNQUSVGLQDAPXO\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ESNQUSVGLQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ESNQUSVGLQDAPXO\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADECG.bat" "15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WRPSHVDMDXBMKIN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "16⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GTAJXTRBWICWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "17⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QVRFSDCGYXTUHNU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exeC:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe19⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYKLIQCJN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFXOLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFXOLGAAPQNWIO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNTYJ.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YKSKTPKUFUAEUVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOFKCTKIT\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TKUQLUFVAFUVSCN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exeC:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBRSPY.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exeC:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFHCACXSGNIMJVR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGDS\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGDS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exeC:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DFABVQELGKYHTPN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exeC:\Users\Admin\AppData\Local\Temp\FTPSVUWIMREBQYQ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exeC:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIYWF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXDTOBJD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNEYCO.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EIDLWAYTRAATJXF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exeC:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGDS\service.exeC:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGDS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSIWSQAVHAUWBRK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEKRCCQVNVJUKG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDABKY.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GQONREIECSYQHGI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TKUQLUFVAFUVSCN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHRM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKDCJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKDCJSIOFWNCMC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPBYWA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESYKG.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EOTMCCEGUCQPBJA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIWER.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTJWEN.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exeC:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exeC:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWKVLH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYNW.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QVSGSDCGYXTVHNU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSBCV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMAABWBSNAHC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIASJGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIASJGBUYKLIRDJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYIQEDEAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYIQEDEAFAVQEL\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IEDQHUQOTFTVAQJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPTGKGDUSIIKFCD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWT.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTMSEA.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTAAGDS\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXVYJOTAAGDS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNEWOKFVOAPYOP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exeC:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDHYVV.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EQRMKNCQXGSXHTF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDHNAMU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJRNW.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKXGGSYPMRMTIJB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGO\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGO\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGO\service.exeC:\Users\Admin\AppData\Local\Temp\TLKSGGHCBHDYTGO\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exeC:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRQFOB.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSJRGQG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXEOXVFCMGHXQTU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exeC:\Users\Admin\AppData\Local\Temp\XQJPWHIBVACSPPL\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFXWS.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNPKIKAOVEQUFRC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPKSG.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DXTOCYJEIYWFRXN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQLTI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHPJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exeC:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exeC:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIUSQ.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QWMKOJRGHXGGPLT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCTLRD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKXNXRPSDHNAMU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMYVAT.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CHVVJKFDGWJQLQA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPWMKO.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "POSFJFDTRIIKFBC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDJARIHS\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDJARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDJARIHS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKLIR.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exe"7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exeC:\Users\Admin\AppData\Local\Temp\NPFXWEYOEJBSJHS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGOAH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLQYJJDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLQYJJDXBEUQR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDQQCK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGJVWER\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGJVWER\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIREDQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPPNVHO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOLTF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWBUYT.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WWKLGEHXKRBMRBN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXFG.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEEFAFBWREL\service.exe"7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exeC:\Users\Admin\AppData\Local\Temp\TWMGELULQIQEOFA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYLKX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLCX\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFVJQK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHUCQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBTXSP.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WJLGEHWKRAMQBNV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYYK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIXVLVPNQBFLYYK\service.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exeC:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVMMKSELP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFTS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exeC:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HYQMHXRCSBRSPXK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIQCJ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFDGWSTBP\service.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IDSXQGQKILXBYGU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFCLD.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MWTEAYLEYFVORTY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXDE.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMXN\service.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWNLP.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDJARIHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPEXVEXNDJARIHS\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exeC:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exeC:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFCRR\service.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempABPYL.txt
TempACESA.txt
TempADECG.txt
TempADESA.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHUCQ.txt
TempAIDYR.txt
TempALULF.txt
TempBEGPL.txt
TempBFXWS.txt
TempBFXWT.txt
TempBFXWT.txt
TempBIWER.txt
TempBIWES.txt
TempBNTYJ.txt
TempBQYQK.txt
TempBRSPY.txt
TempBTXSP.txt
TempBYTRA.txt
TempBYUSB.txt
TempCESAO.txt
TempCIWES.txt
TempCTLRD.txt
TempCXAMY.txt
TempCXQWH.txt
TempCYXBO.txt
TempDABKY.txt
TempDESAO.txt
TempDGHRM.txt
TempDGHRM.txt
TempDGHRN.txt
TempDHIRN.txt
TempDHYVV.txt
TempDOTEQ.txt
TempDQQCK.txt
TempDVUQR.txt
TempDXBMK.txt
TempDXBMK.txt
TempEDHYU.txt
TempEDHYU.txt
TempEFCLD.txt
TempEFDLD.txt
TempEIJSO.txt
TempEIYWF.txt
TempESYKG.txt
TempEWUDD.txt
TempEXVEE.txt
TempEYXMV.txt
TempFFYOJ.txt
TempFTBPO.txt
TempFVJQK.txt
TempFYNJS.txt
TempGAOXK.txt
TempGAOXK.txt
TempGAOXK.txt
TempGBIWE.txt
TempGCDMI.txt
TempGFSWW.txt
TempGHENF.txt
TempGHENF.txt
TempGUCQP.txt
TempGUTFN.txt
TempGYXFG.txt
TempGYXTU.txt
TempGYYUU.txt
TempHBOXK.txt
TempHCAJX.txt
TempHIFOA.txt
TempHQHBL.txt
TempHUFDI.txt
TempHUFDI.txt
TempHXKRB.txt
TempIACQM.txt
TempIGOAG.txt
TempIIRMV.txt
TempIJRNW.txt
TempIJSOB.txt
TempIJTOC.txt
TempIMDDB.txt
TempIMDDC.txt
TempIREDQ.txt
TempJBDRM.txt
TempJGOAH.txt
TempJHLGO.txt
TempJPUFD.txt
TempJSNWN.txt
TempJSOWN.txt
TempJSOWN.txt
TempJTPCO.txt
TempJXFTS.txt
TempJXWIQ.txt
TempKLUQD.txt
TempKOOHA.txt
TempKTFLQ.txt
TempKTPCO.txt
TempKTPDA.txt
TempKVSQU.txt
TempKWHGK.txt
TempKWIGK.txt
TempKWIGK.txt
TempKYGUT.txt
TempLEHIS.txt
TempLHPGE.txt
TempLHVUG.txt
TempLIQCJ.txt
TempLIUSQ.txt
TempLKXEU.txt
TempLPKSG.txt
TempLUQDA.txt
TempMHQHF.txt
TempMHQHF.txt
TempMIRIG.txt
TempMIWVH.txt
TempMIWVH.txt
TempMIWVH.txt
TempMJSEK.txt
TempMKSEL.txt
TempMNWSA.txt
TempMNWSF.txt
TempMNXSA.txt
TempMPQVC.txt
TempMPQVC.txt
TempMQLTI.txt
TempMUGNR.txt
TempMUGNR.txt
TempMVHNS.txt
TempMWSFC.txt
TempMWSFC.txt
TempMYVAT.txt
TempNEYCO.txt
TempNJXWI.txt
TempNJXWI.txt
TempNLPKS.txt
TempNOLTF.txt
TempNOXTA.txt
TempNVHOS.txt
TempNWRRG.txt
TempOPYUB.txt
TempOULIM.txt
TempOWNHB.txt
TempOXTAG.txt
TempPBYWA.txt
TempPNRMU.txt
TempPPYAT.txt
TempPRHVD.txt
TempPTOWK.txt
TempPUGDH.txt
TempPUGEI.txt
TempPVLJN.txt
TempPWMKO.txt
TempPXATT.txt
TempPXATT.txt
TempPXODM.txt
TempPYLKX.txt
TempQBVUJ.txt
TempQVGEI.txt
TempQWNKO.txt
TempQWNLP.txt
TempQYBUU.txt
TempQYBUU.txt
TempRMTII.txt
TempRMUIJ.txt
TempRMUIJ.txt
TempRQFOB.txt
TempRSXDE.txt
TempRSYEF.txt
TempRVQYM.txt
TempSDWWL.txt
TempSQUPX.txt
TempTBPOA.txt
TempTGMRC.txt
TempTJWEN.txt
TempTMSEA.txt
TempTRVQY.txt
TempTRVQY.txt
TempTYFGD.txt
TempTYKIM.txt
TempTYKIM.txt
TempUASWR.txt
TempUASWR.txt
TempUFYAN.txt
TempUFYNW.txt
TempUFYYN.txt
TempUIPKO.txt
TempUKIMH.txt
TempUPYPE.txt
TempUSBCV.txt
TempVASWR.txt
TempVGAOW.txt
TempVGEID.txt
TempVGFJW.txt
TempVGHFN.txt
TempVHFJE.txt
TempVHFJX.txt
TempVHFJX.txt
TempVLXIH.txt
TempVQQFO.txt
TempVQQFO.txt
TempVQQFO.txt
TempVRPTO.txt
TempVYLMJ.txt
TempWALYJ.txt
TempWBUYT.txt
TempWCUYT.txt
TempWFFYO.txt
TempWRRGP.txt
TempWRRGP.txt
TempWVRSS.txt
TempXDVUQ.txt
TempXDVUQ.txt
TempXDVUR.txt
TempXFNEC.txt
TempXGGPK.txt
TempXGHPL.txt
TempXJHLG.txt
TempXJSJD.txt
TempXMIQH.txt
TempXNIRI.txt
TempXNLPK.txt
TempXSSHQ.txt
TempXWSTT.txt
TempXWTTU.txt
TempYJHLG.txt
TempYKLIR.txt
TempYKQVH.txt
TempYKQVH.txt
TempYRWIE.txt
TempYUASW.txt
TempYVBTX.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/664-4520-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1036-3687-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1352-2131-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1604-2326-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2204-4015-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2448-3855-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2768-3345-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2780-3978-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2832-4619-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3000-3671-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3032-1501-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3040-4483-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-4071-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-4569-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-3777-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-1411-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-2970-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-5184-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-4849-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-1412-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-3956-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-3386-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-2531-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-4345-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3044-1951-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3320-5043-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3496-3923-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3544-3797-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3672-1737-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3976-4590-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4416-4259-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4756-3012-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-1738-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4896-3830-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5008-1631-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5040-3248-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5176-2954-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5184-3945-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5220-3790-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5292-3078-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5484-4206-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5560-3230-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5700-3149-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5744-4343-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5808-3413-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5920-2891-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5960-5343-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6036-4288-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6136-3352-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6248-5408-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6396-5157-0x0000000000400000-0x0000000000471000-memory.dmp