Analysis
- max time kernel
13s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 17:57
General
- Target 509d77fca90b9f44414210308e4ba5a3e7c344ca473fdbe1a525e4d80b0ae0c8.exe
- Size 522KB
- Sample260910-wjtk6seq3x
- SHA256 509d77fca90b9f44414210308e4ba5a3e7c344ca473fdbe1a525e4d80b0ae0c8
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 60 IoCs
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 21 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
- Suspicious use of WriteProcessMemory 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\509d77fca90b9f44414210308e4ba5a3e7c344ca473fdbe1a525e4d80b0ae0c8.exe"C:\Users\Admin\AppData\Local\Temp\509d77fca90b9f44414210308e4ba5a3e7c344ca473fdbe1a525e4d80b0ae0c8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTIRDY.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVASXSOPCHOPXAT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVUGPG.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFJFDTRIIKFBCLH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACFRSNLODRYHTYI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCHYUU.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DPQLJMBPWGRWGTE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENEYC.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UGEIDKWAXSRATJW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFXVEF.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADECG.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPDAOW.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ANDRNLQCQSNGJKT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKIQCIN\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKIQCIN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKIQCIN\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULKAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULKAU\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBCQML.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBTXSP.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMBPWG.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLLSHGHDBIDYTGO\service.exe"C:\Users\Admin\AppData\Local\Temp\TLLSHGHDBIDYTGO\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIKTPC.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPYPE.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVMNKS.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUA.bat" "21⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSIWSPAUHAUWBRK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe" /f22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe22⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exeC:\Users\Admin\AppData\Local\Temp\DLCUMIDWNOLTFMQ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TSEMEWNKEUOPYOP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OTPDPBYDWVRSFKR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMQRWD.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HUBKYUSCXJCWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMYVU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSRDLD.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"C:\Users\Admin\AppData\Local\Temp\IETYRHRLJMYBHUU\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWSTT.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHLCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHLCN\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVEQW.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNGKBT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEJW.bat" "15⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDFRSNLODRYITYI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKBTKHCVLMJSEKP\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTKHCVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BKBTKHCVLMJSEKP\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPWMK.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYOYSQTEJOBNV\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGPBHM.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVEPW.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "19⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QVRFSDBGYXTUHMT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe" /f20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACPYL.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "22⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIJURPTOWKLDKLU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe" /f23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDJOAB.bat" "23⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXRJPB.bat" "24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSWUWIMSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSWUWIMSFCRQE\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "25⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQWC.bat" "26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRFCQQ.bat" "27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKBTLHCVLMKSELP\service.exe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYKSK.bat" "28⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WJNJHXVMLNIBFGP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe" /f29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe29⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IEDQHUQOTFTVAQJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHFRON.bat" "3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JHLGOCDWUDDWMIQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIRDJ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWTTBP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEDHYU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYKKIQCJN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UTHIDCEUHPJOLWT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJXSBVXLPVBCIAF\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXSBVXLPVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXSBVXLPVBCIAF\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSF.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBVUJS.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIM.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FAWPUNDNHFIYUVD\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYUABH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IVRAUYWKOUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRAUYWKOUABHET\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVRFC.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANTKSGRH\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBHVD.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EYDOLKOBFBPVNEE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHJSOB.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJRNW.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exeC:\Users\Admin\AppData\Local\Temp\PIXHPDDEYEAVQDK\service.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKXAXF\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSTYEF.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JWDMWTEAYLEYFVO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TYUIUGEIWXAKPWX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHBG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGWXUD.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRCONOJIOKANVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRCONOJIOKANVEP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNLPKS.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CXTOBXJYDIYWFQX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIQM.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTP.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAOTYFGDLEIX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFGDM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFVSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFVSSA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUJJ.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDLXVT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSOWNC.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exeC:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "URFRCBFXWSUGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUBXXR.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLJMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLJMYCHVUG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MRNBOWCUYTPQDJQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDHIRN.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCMD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\NPFXVEYNEJBSJHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXUUC\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUII.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEID.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEKBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEKBSJIT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SXTHUFDIVWJPWWH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXTTU.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PKILAOVEQVFRDBF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRCVVK.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQL.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVATX.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VVJKFDGWJQALQAM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe:*:Enabled:Windows Messanger" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBQAIROJDDSTQLR\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFOF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAQHRNICCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAQHRNICCRSPYKQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHJSOB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TVLFDKTKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\TVLFDKTKPHYPDNE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHTED.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYGQGLDULKAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYGQGLDULKAU\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXIUF.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLHPG.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHIFN.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTYFGDMEJY\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTYFGDMEJY\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOC.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AWVMCQMKYPBPRMF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWLXIH.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNR\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUPYPE.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGBAGCXSFN\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKTKE.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MIWVLVPNPBFKYXK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWVLVPNPBFKYXK\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIM.bat" "17⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ONHQYIEPIJTWXJK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGVJQL.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQPXLLMHGMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPXLLMHGMIYLSC\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTURBM.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe20⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exeC:\Users\Admin\AppData\Local\Temp\IRIFATXJKHQCINB\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQOSNV.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HXYVEEPWMKOJRFG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQXM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXWLU.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQLEHI.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NDYVUYLBPLJXOAO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GVUIJECFVIPKPMX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exeC:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exeC:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVKKL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGPG.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RWIGKFNBYCVTCCV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSRGP.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVEQW.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBYUSB.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPJBHOXAANTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\WPJBHOXAANTLTHR\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exeC:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exeC:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJEJYW.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRN.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWGSSTOMTPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWGSSTOMTPFSAJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXH\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exeC:\Users\Admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYFOF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCRSQYKQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCTNBID\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJDXEU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKKRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKKRGFGCAHCXSFN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISO.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPGXODND\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSECGB.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPNQBGLYKS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLGUTG.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBCHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYWKPUBCHAE\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIWDR.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MREIEBSXQGGIDAB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXYVEQ.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASDPOPLJQLBOWF\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempORGUC.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OPMUHNSDBFAIUVQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWL.bat" "17⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exeC:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\GPGYQMHBBQROXJP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPFSAJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWOCMC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFMQC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOEPIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOEPIGJVWES\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFTS.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHQDYC.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exeC:\Users\Admin\AppData\Local\Temp\ORGAXFPFKCTKJTR\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLJNI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPKXNXRPSDINAMU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDHIRN.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCMD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKIQCIN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYJKIQCIN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHUCQ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPWL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJPLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASDPOPLJPLBOWF\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\TASDPOPLJPLBOWF\service.exeC:\Users\Admin\AppData\Local\Temp\TASDPOPLJPLBOWF\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exeC:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exeC:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIRM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAONHC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exeC:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PHXHPDCDYEUPDKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXHPDCDYEUPDKE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAVOUG.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPNQBGLYKS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIVCTL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUJJ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDLXVT.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GBXQVOEOIGJVWES\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKTFLQ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exeC:\Users\Admin\AppData\Local\Temp\DRNPTRUFKPCOWNB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMBPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTDPPQLJQMBPWG\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXES.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPMLPDGCAQWPFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGPG.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFT.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HCYRWPFPJHKWAXF\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AJXSBVXLPVBCIAF\service.exeC:\Users\Admin\AppData\Local\Temp\AJXSBVXLPVBCIAF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempURBMS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPVMK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exeC:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDLCXA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBCXDTOCJD\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNFKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNFKBM\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCWCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCWCTOBID\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYUUV.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIREYD.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPNVHO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NREIEBSYQGGIDAB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYKK.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHF.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCSBJTPKEETURAA\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SXTHUFEIVWJPWWH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQXH\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQXH\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGNRD.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLWMI\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLWMI\service.exeC:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLWMI\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBQROX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exeC:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exeC:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exeC:\Users\Admin\AppData\Local\Temp\TWLFELUKQHYPDOE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUTFNF.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDCGYX.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ADOPLJLBOWFQVFS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exeC:\Users\Admin\AppData\Local\Temp\LNDVTCWMCHQHFQO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFFYOK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUNTFB.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBYEW.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKAYMNIGJMTDOTD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTURAA\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTURAA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVRSS.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOXGCQUGHENFKAY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOXGCQUGHENFKAY\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSQAT.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AQROXJPUFDHCKWA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUQFTBJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exeC:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNDQXH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUEQQRMKRNCQXH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQWC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSDERXPWLVLH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RPUHLHEVTJJLGCE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPFXVEYNEJBSJHS\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTKHCVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BKBTKHCVLMJSEKP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFYYN.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOWF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKJPLBOWF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVMNKS.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYTJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYTJXFN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempORGUC.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OPMUHNSDBFAIUVQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHEMFK.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exeC:\Users\Admin\AppData\Local\Temp\GPHDSWIJGPBHMCO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYXJR.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VIMIGWULKMHAEFO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempALYJH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exeC:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPUBC.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSJWSQAVHBVXCSL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exeC:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exeC:\Users\Admin\AppData\Local\Temp\SLEKRCDQWNVKUKG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LIITQOSNVJLDKKT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IXYVEEQWNKOJRGH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exeC:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exeC:\Users\Admin\AppData\Local\Temp\LNDVUCWMCHQHGQO\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exeC:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYRWIE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIJURPTOWKLDKLU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exeC:\Users\Admin\AppData\Local\Temp\SKJRFFGBGCXSFMH\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exeC:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exeC:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTURAA\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJEDTURAA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRDJO.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OBJASKGBRKLUXKL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DVNTMCMGEGXTUBP\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTMCMGEGXTUBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTMCMGEGXTUBP\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DVNTMCMGEGXTUBP\service.exeC:\Users\Admin\AppData\Local\Temp\DVNTMCMGEGXTUBP\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exeC:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exeC:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQXH\service.exeC:\Users\Admin\AppData\Local\Temp\VCUEQQRMLRNDQXH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHF.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MSXJGKFNCDVTCDW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CAEHTUPNQFTBJBV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempADESA.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BVAXLXIHLYCMSKB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJAESY.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVDAYOSXEFCLDI\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENJXW.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIAQIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIAQIGR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSSHQ.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PLLXUSWRYNOBGNO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNKSF.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VDRQCKCTLHCSMMW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exeC:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHOSE.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFNFWOKFVOAPPQN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGDH.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GYPMGWQBRBQROXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHADFO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exeC:\Users\Admin\AppData\Local\Temp\OGWFNCBCXCTOBJD\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBBCWCTNBID\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDRYHS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QSICYAHQHMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\QSICYAHQHMEVMAK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPSTYF.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDUQQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WTSWJNJHXVMMOJC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDUMSE.bat" "6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTYRHRLJMYCHVU\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTYRHRLJMYCHVU\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\JFTYRHRLJMYCHVU\service.exeC:\Users\Admin\AppData\Local\Temp\JFTYRHRLJMYCHVU\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exeC:\Users\Admin\AppData\Local\Temp\JCRBJSPKEETURAA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSDWW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDKFVIQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDKFVIQK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYNJR.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWIOT.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exeC:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exeC:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMBKWT.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDL.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRINFWNBLC\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRINFWNBLC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOBN.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WUMCQLJYOBOQLEH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVUYLBPLJXOAOQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDESA.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGUBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGUBK\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGUBK\service.exeC:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGUBK\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exeC:\Users\Admin\AppData\Local\Temp\YFYIUTUQOVQGTBK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYCCB.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TVQOQGUBKBVLXIH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKPDAPXO\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKPDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKPDAPXO\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSUGKPDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSUGKPDAPXO\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXOPMUGNR\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKEETURAB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRPSHV.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "APQNWIOTFCGBJVW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YARKQXIJCWBDTQQ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YARKQXIJCWBDTQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YARKQXIJCWBDTQQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMFJYA.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NXVFBMFGXQTUGHE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIRDJ.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OAJASKGBRKLUXYK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YARKQXIJCWBDTQQ\service.exeC:\Users\Admin\AppData\Local\Temp\YARKQXIJCWBDTQQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUOPYO.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IKWAXFTSEMEVNJE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDMDXB.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IOTFDHCKVWSQSIV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRIQFPFB\service.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYWFFQXNLPKSGIY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SUKECJTJOGXOCND\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESAON.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WKWIGKYCMRYKAAC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAVOUMDNGFHXTUC\service.exe" /f4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exeC:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGWTTBP\service.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempABPYL.txt
TempACESN.txt
TempACPYL.txt
TempADECG.txt
TempADESA.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHHQM.txt
TempAHIQM.txt
TempAHIRM.txt
TempAHUCQ.txt
TempALYJH.txt
TempAONHC.txt
TempAVOUG.txt
TempBCQML.txt
TempBDESA.txt
TempBIWDR.txt
TempBPYKK.txt
TempBPYLK.txt
TempBPYLK.txt
TempBPYLK.txt
TempBPYLK.txt
TempBPYLK.txt
TempBQROX.txt
TempBTXSP.txt
TempBVUJS.txt
TempBYUSB.txt
TempCFGQL.txt
TempCHYUU.txt
TempCIWES.txt
TempCJXES.txt
TempCJXFS.txt
TempCJXFT.txt
TempCUYTP.txt
TempCXAMY.txt
TempDCGYX.txt
TempDGIRN.txt
TempDHIRN.txt
TempDJOAB.txt
TempDLCXA.txt
TempDLXVT.txt
TempDMDXB.txt
TempDMYVU.txt
TempDRYHS.txt
TempDUMSE.txt
TempDXBMK.txt
TempDXWLU.txt
TempEDHYU.txt
TempEHIRN.txt
TempEHISO.txt
TempENEYC.txt
TempENJXW.txt
TempEPVMK.txt
TempEPWMK.txt
TempESAON.txt
TempEYNJR.txt
TempEYXMV.txt
TempFFYOK.txt
TempFGPLY.txt
TempFOKYX.txt
TempFTBPO.txt
TempFXVEF.txt
TempGAOXK.txt
TempGBHVD.bat
TempGHENF.txt
TempGPBHM.txt
TempGUCQP.txt
TempGVJQL.txt
TempGWXUD.txt
TempGYUUV.txt
TempHADFO.txt
TempHEMFK.txt
TempHFRON.txt
TempHIFOA.txt
TempHJSOB.txt
TempHJSOB.txt
TempHPBIM.txt
TempHPBIM.txt
TempHQDYC.txt
TempIACQM.txt
TempIJRNW.txt
TempIJSOC.txt
TempIKTPC.txt
TempIRDJO.txt
TempIREYD.txt
TempIRNVM.txt
TempIVCTL.txt
TempJAESY.txt
TempJBDRN.txt
TempJDXEU.txt
TempJEJYW.txt
TempJSOBN.txt
TempJSOWN.txt
TempJWHGK.txt
TempJXFTS.txt
TempKHQCI.txt
TempKHQCI.txt
TempKTFLQ.txt
TempKWIGK.txt
TempKXFOF.txt
TempKYFOF.txt
TempKYGUT.txt
TempKYGUT.txt
TempKYGUT.txt
TempKYXJR.txt
TempLGUTG.txt
TempLHQHF.txt
TempLHQHF.txt
TempLHVUG.txt
TempLHVUG.txt
TempLIRDJ.txt
TempLIRDJ.txt
TempLPQVB.txt
TempLYCCB.txt
TempLYGPG.txt
TempLYGPG.txt
TempLYKSK.txt
TempMBKWT.txt
TempMBPWG.txt
TempMFJYA.txt
TempMHQHF.txt
TempMIWVH.txt
TempMIWVH.txt
TempMIWVH.txt
TempMJSEK.txt
TempMNKSF.txt
TempMNWSA.txt
TempMNWSF.txt
TempMPQWC.txt
TempMPQWC.txt
TempMQRWD.txt
TempMUGNR.txt
TempMVHNS.txt
TempMVREB.txt
TempMVREB.txt
TempMVREB.txt
TempMVRFC.txt
TempNGKBT.txt
TempNJXWI.txt
TempNJXWI.txt
TempNJXWI.txt
TempNLPKS.txt
TempNWIOT.txt
TempOPUBC.txt
TempOPYUA.txt
TempORGUC.txt
TempOVKKL.txt
TempOXTSH.txt
TempOXTSH.txt
TempPDAOW.txt
TempPFSAJ.txt
TempPSTYF.txt
TempPTOWL.txt
TempPUGDH.txt
TempPUGEI.txt
TempPXODM.txt
TempPXODM.txt
TempPYPEN.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQBYEW.txt
TempQLEHI.txt
TempQOSNV.txt
TempQSXDE.txt
TempQUPWL.bat
TempQUPXL.txt
TempQVGEI.txt
TempRCVVK.txt
TempRFCQQ.txt
TempRMUII.txt
TempRPSHV.txt
TempRSDWW.txt
TempRSXEF.txt
TempRVQXM.txt
TempRVQYM.txt
TempSDWWL.txt
TempSECGB.txt
TempSOWNC.txt
TempSQUPX.txt
TempSRDLD.txt
TempSTYEF.txt
TempSXIUF.txt
TempTFGDM.txt
TempTFMQC.txt
TempTIRDY.txt
TempTURBM.txt
TempUASWR.txt
TempUASWR.txt
TempUBXXR.txt
TempUFYYN.txt
TempUFYYN.txt
TempUFYYN.txt
TempUFYYN.txt
TempUGEIW.txt
TempUGNRD.txt
TempUNTFB.txt
TempUOPYO.txt
TempUPYPE.txt
TempUQYPE.txt
TempURBMS.txt
TempUTFNF.txt
TempVGEID.txt
TempVGEJW.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJX.txt
TempVHIFN.txt
TempVHNSE.txt
TempVHNSE.txt
TempVHOSE.txt
TempVJKKT.txt
TempVJKKT.txt
TempVLJNI.txt
TempVMNKS.txt
TempVUGPG.txt
TempWALYJ.txt
TempWFFOK.txt
TempWHFJE.txt
TempWHFJE.txt
TempWHTED.txt
TempWIOTF.txt
TempWLHPG.txt
TempWLXIH.txt
TempWSRGP.txt
TempWSSHQ.txt
TempWVRSS.txt
TempWVRSS.txt
TempXDVUQ.txt
TempXGGPL.txt
TempXGGPL.txt
TempXGHPL.txt
TempXGHPL.txt
TempXGHPL.txt
TempXRJPB.txt
TempXSQAT.txt
TempXWSTT.txt
TempXXTTU.txt
TempXYVEQ.txt
TempYAHHQ.txt
TempYFGDL.txt
TempYKTKE.txt
TempYRWIE.txt
TempYUABH.txt
TempYVATX.txt
TempYVEPW.txt
TempYVEQW.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/1212-4843-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1240-4346-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1436-5481-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1612-4994-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1756-5734-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1780-3282-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2028-5890-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2064-2461-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2528-2769-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2804-2988-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2928-2543-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2988-3502-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3148-4979-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3384-2165-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3764-4869-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3928-4558-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4156-5775-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4268-5365-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4304-4768-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4680-4125-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4872-4489-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-5378-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-5034-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-967-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-1432-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-2490-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-3015-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-4292-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-5899-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-4718-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-3471-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-2100-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-433-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-431-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-5746-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4952-3887-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5032-4309-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5144-1410-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5296-1846-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5336-2554-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5404-5727-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5408-4324-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5524-3503-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5632-5745-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5660-5325-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5748-3168-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5892-4527-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5904-5104-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6080-3520-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6284-4748-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6460-4870-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6480-5828-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6528-4980-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6624-4490-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6976-4594-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7008-3948-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7068-5796-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7144-5665-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7148-5726-0x0000000000400000-0x0000000000471000-memory.dmp
memory/7156-4747-0x0000000000400000-0x0000000000471000-memory.dmp