Analysis
- max time kernel
15s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/09/2026, 21:38
General
- Target a88ca5737cadf801764b1d7c142aaa742e523e788fcb5fb231928ae607780946.exe
- Size 520KB
- Sample260912-1g59eaad64
- SHA256 a88ca5737cadf801764b1d7c142aaa742e523e788fcb5fb231928ae607780946
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 46 IoCs
- Checks computer location settings 2 TTPs 20 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 27 IoCs
- Adds Run key to start application 2 TTPs 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 24 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a88ca5737cadf801764b1d7c142aaa742e523e788fcb5fb231928ae607780946.exe"C:\Users\Admin\AppData\Local\Temp\a88ca5737cadf801764b1d7c142aaa742e523e788fcb5fb231928ae607780946.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYFAV.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FEIWXJPWXIACQYL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVACSOPL\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVACSOPL\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVACSOPL\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BYMYJIMDNTLCCEF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEGPL.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BVTRVJNIGXVLLNI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEVMAK\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEVMAK\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HRNIYRCSCRSPYKQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SQVIMIFWUKKMHAE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULJAU\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULJAU\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJSEKP\service.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMOXTA.bat" "10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTMPQV.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LEUDLAVARMGBGVW\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWIOT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPCOWO.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ANDRNKPCPRMFJKT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLAIUS.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNSLBLFDGWSTBP\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTTNFL.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYX\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXFNEY.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRRPXJQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRRPXJQ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDEBJC.bat" "17⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YUSCXJCWYDTMQRW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHVUG.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJARIHS\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGPBYW.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DUNTLCMFEGWSTBP\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWUTXK.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKOUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKOUABHET\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVFSDC.bat" "21⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSKIT\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJUKG\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYI\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "24⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXSRXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXSRXTJWENE\service.exe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIV.bat" "25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJASKGBULLJRDKO\service.exe"C:\Users\Admin\AppData\Local\Temp\BJASKGBULLJRDKO\service.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSEMEH.bat" "26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRTXVYJOTAGDSR\service.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "27⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IRNIYSDSCSTQYLR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe" /f28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKOPYU.bat" "28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBWPVNDOHFIYUVD\service.exe29⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLMJR.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UCQPBJASKGBRKLU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HRNIYRCSCRSPYKQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKUPDA.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWANERNLQCQSNGJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSPYK.bat" "5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"C:\Users\Admin\AppData\Local\Temp\TASCOOPKIPLAOVF\service.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSDWW.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\IKWWAXSQXTJWENE\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAG.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDIPBBPUMUISJ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIFOA.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YASKQXIJCWBDTQQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRRE\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKFVJQL\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVEQW.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exeC:\Users\Admin\AppData\Local\Temp\HDSXQGQKIKXAYGT\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEVMAK\service.exeC:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEVMAK\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCLHVU.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PNRFJECTYRHHJEA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OKLWTRVQYMNAGNN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVEQVF.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUNDNGFHYUVC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUNDNGFHYUVC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPSTYF.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESRDL.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNBMC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCKCF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXJ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBCQML.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRSOMTOESIT\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRSOMTOESIT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJSOB.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HRNIYRDSCRSPYKQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHXKSB.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXCUSBVKYAGOF\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJXWJ.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exeC:\Users\Admin\AppData\Local\Temp\ORHBXGPFLCTKJUR\service.exe18⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPJ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCLHVU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PNRFJECTYRHHJEA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBOXK.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWTHTEDHYUWIOVV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCWV.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYMT\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGNIMJ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBNK.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAQQOWIP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXLSBN.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJEUIPK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRUVHI.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHUCQ.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVAXSQXTIWEMD\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUGHEMFJYA\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exeC:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJMNXT.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SIEDRHUQOTGTVAQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCINA.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJTR\service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYQWIE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUNTFB.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMOXTA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYBBOUMUIS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBJBES.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"C:\Users\Admin\AppData\Local\Temp\IAQHRNIDCSSQYKR\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESAJA.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCHYUU.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFATXJKHQCINA\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVQQFO.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSGGHCAHDYTGN\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSGGHCAHDYTGN\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKNPYU.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLEJQCCQVNVJTK\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTIRED.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUCWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUCWMCHQHGQO\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLCGUM.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GBQVOEEGBIWESRD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exeC:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe14⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exeC:\Users\Admin\AppData\Local\Temp\LOEWUDXMDIARIGR\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJY\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJY\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSXEFC.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYMXNJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUJXFN.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPYK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVOTFB.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"C:\Users\Admin\AppData\Local\Temp\ESORUTVHLQDBPXP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLXIH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFGD.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQOSNV.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DRREGBCXRFMHLIU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOWO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGDENJ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMJ.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQL.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exeC:\Users\Admin\AppData\Local\Temp\QTJDBIRHNEVMBLB\service.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXNGFMVLRIQFPFB\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYNJR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGBFVW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLFAFUVSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOERIT.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWBRKN.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YFXIUTUPOUQGTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXIUTUPOUQGTBK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXBBY.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPDAOWO\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPDAOWO\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJABDR.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AUVJWHGKXYBLRYY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHHFN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempABPYL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSNDRYH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVASWR.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAFUVS.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNIYMT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNUJJK.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FABWRELGLYHTQNS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HVCLYUSCXJDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEFBGBWRFMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEFBGBWRFMG\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNKTFLQ\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAB.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPUMUITJ\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCWYDT.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe19⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULJAU\service.exeC:\Users\Admin\AppData\Local\Temp\PRHBYGQGLDULJAU\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFRXN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAT.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKFEKGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKFEKGWJRA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSELQ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHFIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHFIYUVD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPGAK.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDRWHIGOAHLCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDRWHIGOAHLCN\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKDGHR.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOFWNCMC\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTEQPQMKRMCPXG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTEQPQMKRMCPXG\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWWAXSQXTIWEME\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWWAXSQXTIWEME\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRCVVK.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exeC:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSC\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exeC:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCKCF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTXVYJNTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTXVYJNTAGDSR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFUIPK.bat" "5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNIRI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVTB\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUQLGAFUVTB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACPYL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDEAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDEAFAVQEL\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXFNEC.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AKXTBWYMQVCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\AKXTBWYMQVCDAJB\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFNE.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exeC:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exeC:\Users\Admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGQO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHJSO.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLMJS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUIIJECJFVIPK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQDAPX.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AOESNLQDQSNGJLU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWBUYT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPENAW.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIT\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVBTX.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BLYUCXNRWDEBKCH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNIWVI.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPTHKGEUTJJLGCD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBMTYJ.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCG\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YLNIGIYMTCNSDPA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ENXFBPUGGEMFJYA\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGGEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBPUGGEMFJYA\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLT.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRTYEF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMWRFC.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPIBHOXANTKSHRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WPIBHOXANTKSHRH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPWMK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CQLYOYSQTEJOBNV\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUFDI.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AJASKGBUYKLIRDJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSLPQV.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGAFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUAQLGAFVW\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLXIH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe9⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe:*:Enabled:Windows Messanger" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOMUGMR\service.exe:*:Enabled:Windows Messanger" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f11⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f11⤵
- Modifies registry key
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGWKRA.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTSAYUKXAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHWKRA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTHOJO.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LPUBCHAFTTHIDBE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBNVNH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exeC:\Users\Admin\AppData\Local\Temp\CQMYOSQTEJOBNVN\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPOQLJQLBPWF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLNIBF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLLMHFMIYLSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUYKIM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exeC:\Users\Admin\AppData\Local\Temp\AOKYWMXQORCHMLT\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exeC:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWNKO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOCNWN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSRTFJOCNWN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJKHQC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYHHSPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUNDNHFHYUVC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUNDNHFHYUVC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IEDQHUQOTFTVAQJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTIS\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTIS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJPUFD.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exeC:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exeC:\Users\Admin\AppData\Local\Temp\FNEWOKFAYPQNVHO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPQMKRMCQXG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XVTYLBPKIXNANPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIIRNV.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEAUPDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEAUPDK\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEAUPDK\service.exeC:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEAUPDK\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exeC:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exeC:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKBSJIT\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exeC:\Users\Admin\AppData\Local\Temp\RUKECJSJOGXOCMD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUKIMH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQORCHMLT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREC.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DYCPFTPNSERUPIL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJRDKP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWAAXX.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFBQUGHEMFJYA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXSSH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHXUUC\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVMGA.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"C:\Users\Admin\AppData\Local\Temp\GQHESWIJGPBHMCO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDXWL.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDBIEUHOJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLOPVB.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWOVKUKG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LQNBNYVBTXSOPCI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPRVTWHMREBQYQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUTFNF.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVPIOA.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PRDJQQBVUJSFESV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFAWPU.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JWXAKQXXIBCQMLY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exeC:\Users\Admin\AppData\Local\Temp\AIRJFATYJKHQCIN\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exeC:\Users\Admin\AppData\Local\Temp\GYJVUVRPWRHUCLC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIJRNW.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKXGGSYPMRMTIJB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempULIMH.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exeC:\Users\Admin\AppData\Local\Temp\AOKYWNXQPRDHMLT\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exeC:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exeC:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOAHMCN\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exeC:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JIVCLVTDYKDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFOKY.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRBMSX.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHXPDND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTJPHXPDND\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWXUDO.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAFMWMRJRFQG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUFGTAQYNXNJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSMNWM.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GIYVVDRQCKCULIC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exeC:\Users\Admin\AppData\Local\Temp\QTICAHRHMEVMALB\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exeC:\Users\Admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOWKL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exeC:\Users\Admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exeC:\Users\Admin\AppData\Local\Temp\UOGMTEFSYPXMWMI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHIQM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDUOCJE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFUSISMKNCIVVHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVLYBGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVLYBGPG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEGBIW.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBYUKXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBYUSBYUKXAF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVSST.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFNAGLB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTP.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFOF.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAQHRNICCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAQHRNICCRSPYKQ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRPTO.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXLWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXLWMI\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJBDRN.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFCKDI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQI.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXATT.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFGPLY.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPQVC.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFLSDERXOWLVLH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKSOXO.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GLYHHTQNSNUJKCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exeC:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTIS\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTIS\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exeC:\Users\Admin\AppData\Local\Temp\RLEKRCDQVNVJUKG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFBPUGGEMFJYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENXFBPUGGEMFJYA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGTBPO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYAT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVJJKFDKGWJQA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAMYJI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUII.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHAEFO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQEEFAFBWREMG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IRNIYSDSCSTQYLR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exeC:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exeC:\Users\Admin\AppData\Local\Temp\PIYHPDDEYEAVQDK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDSXJG.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRMPTRUFKPCOWNB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLUQDA.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHFMVLRJRFPGB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHOSE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGTSF.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exeC:\Users\Admin\AppData\Local\Temp\KNDVTCWLBHPGFQN\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WOOWKJKGELGWKRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQML.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJOLW.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYQEOE\service.exe"C:\Users\Admin\AppData\Local\Temp\TWMGELUKQIYQEOE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBQRPXJP\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXODM.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HMJJURPTOWKMELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVUYLBPLJXOANQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUSBCV.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMTXJH.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YKSJTPKTFUEUUSB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exeC:\Users\Admin\AppData\Local\Temp\NQGAYWFOEKCSJIT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exeC:\Users\Admin\AppData\Local\Temp\FPYGDRVHIFOAGLB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTGJKD.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EFXVEFYNJSJHSQO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ESNQUSVGKQDAPXO\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ESNQUSVGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ESNQUSVGKQDAPXO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBOWCU.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DIXWKLGEHXKRBMR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OQLJLBPWFRVGSDC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ESNQUSVGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ESNQUSVGKQDAPXO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCOUKI.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exeC:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exeC:\Users\Admin\AppData\Local\Temp\VOHNUFGTAQYNXNJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJRIC.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MHFWUKKMHADFOKY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNXTAG.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EDRHVQOTGTVAQJM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUDPU\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exeC:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exeC:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempABPYL.txt
TempACPYL.bat
TempACQML.txt
TempAFUVS.txt
TempAHIQM.txt
TempAHUCQ.txt
TempAHVDQ.txt
TempAHVDR.txt
TempAHVDR.txt
TempAMYJI.txt
TempBCQML.txt
TempBEGPL.txt
TempBJBES.txt
TempBMTYJ.txt
TempBNVNH.txt
TempBOWCU.txt
TempCAJXF.txt
TempCFGQL.txt
TempCFGQM.txt
TempCHYUU.txt
TempCIWES.txt
TempCLHVU.bat
TempCOUKI.txt
TempCUYTP.txt
TempCWYDT.txt
TempDEBJC.txt
TempDESAO.txt
TempDGHQM.txt
TempDGIRN.txt
TempDPVMJ.txt
TempDSXJG.txt
TempDXBMK.txt
TempDXBNK.txt
TempEFOKY.txt
TempEGBIW.txt
TempEHIRN.txt
TempEHJSO.txt
TempEPWMK.txt
TempESAJA.txt
TempESRDL.txt
TempEYNJR.txt
TempFAWPU.txt
TempFCKDI.txt
TempFGPLY.txt
TempFGPLY.txt
TempFOKYX.txt
TempFUIPK.txt
TempFYOJS.txt
TempGAOXK.txt
TempGAOXK.txt
TempGAOXK.txt
TempGBOXK.txt
TempGDENJ.txt
TempGHENF.txt
TempGNIMJ.txt
TempGPBYW.txt
TempGTBPO.txt
TempGUCQP.txt
TempGWKRA.txt
TempGYXTU.txt
TempGYXTU.txt
TempHAEFO.txt
TempHIFOA.txt
TempHIRMV.txt
TempHPGAK.txt
TempHUFDI.txt
TempHWKRA.txt
TempHXKSB.txt
TempIACQM.txt
TempIIRNV.txt
TempIJRNW.txt
TempIJSOB.txt
TempJABDR.txt
TempJBDRN.txt
TempJKHQC.txt
TempJLUQD.txt
TempJLUQD.txt
TempJMNXT.txt
TempJPUFD.txt
TempJSOWN.txt
TempJSOWN.txt
TempJWHGK.txt
TempJWHGK.txt
TempJXFNE.txt
TempKDGHR.txt
TempKNPYU.txt
TempKOPYU.txt
TempKSELQ.txt
TempKSOWO.txt
TempKSOXO.txt
TempKUPDA.txt
TempKXBBY.txt
TempKXFOF.txt
TempKYFAV.txt
TempKYGUT.txt
TempLAIUS.txt
TempLCGUM.txt
TempLNIBF.txt
TempLOPVB.txt
TempLUQDA.txt
TempMHQHF.txt
TempMHVUG.txt
TempMIWVH.txt
TempMNWSA.txt
TempMNWSA.txt
TempMOXTA.txt
TempMPQVC.txt
TempMTXJH.txt
TempMVHNS.txt
TempMVREC.txt
TempMWRFC.txt
TempNIWVI.txt
TempNJXWI.txt
TempNUJJK.txt
TempNVMGA.txt
TempNWIOT.txt
TempNXTAG.txt
TempOERIT.txt
TempOJOLW.txt
TempOJXWJ.txt
TempOMQLS.txt
TempOMQLT.txt
TempOPYAT.txt
TempOPYUB.txt
TempOPYUB.txt
TempOXODM.txt
TempOXSSH.txt
TempOXTAB.txt
TempOXTAB.txt
TempOXTAG.txt
TempOXTSH.txt
TempPCOWO.txt
TempPENAW.txt
TempPPYAT.txt
TempPPYAU.txt
TempPSTYF.txt
TempPUGEI.txt
TempPXATT.txt
TempPXODM.txt
TempPXODM.txt
TempPYPEN.txt
TempQBUUJ.txt
TempQCINA.txt
TempQCKCF.txt
TempQCKCF.txt
TempQDAPX.txt
TempQOSNV.txt
TempQRWDE.txt
TempQRWDE.txt
TempQSXDE.txt
TempQVGEI.txt
TempQVGEI.txt
TempQWMKO.txt
TempQWNKO.txt
TempRBMSX.txt
TempRCVVK.txt
TempRMUII.txt
TempRMUIJ.txt
TempRRCWV.txt
TempRSDWW.txt
TempRSPYK.txt
TempRSXEF.txt
TempRSXEF.txt
TempRSXEF.txt
TempRTYEF.txt
TempRUVHI.txt
TempSDWWL.txt
TempSDXWL.txt
TempSEMEH.txt
TempSLPQV.txt
TempSMNWM.txt
TempSXEFC.txt
TempTBPOA.txt
TempTBPOA.txt
TempTGJKD.txt
TempTHOJO.txt
TempTIRED.txt
TempTMPQV.txt
TempTOWKL.txt
TempTOWKL.txt
TempTRVQY.txt
TempTTNFL.txt
TempTYFGD.txt
TempUFEIV.txt
TempUFEIW.txt
TempUGEIW.txt
TempUJXFN.txt
TempUKIMH.txt
TempULIMH.txt
TempUNTFB.txt
TempUQYPE.txt
TempUSBCV.txt
TempUTFNF.txt
TempUYKIM.txt
TempVASWR.txt
TempVEQVF.txt
TempVFSDC.txt
TempVHFJE.bat
TempVHFJE.txt
TempVHHFN.txt
TempVHOSE.txt
TempVJKKT.txt
TempVLXIH.txt
TempVLXIH.txt
TempVOTFB.txt
TempVPIOA.txt
TempVQQFO.bat
TempVRPTO.txt
TempWAAXX.txt
TempWBRKN.txt
TempWBUYT.txt
TempWFRXN.txt
TempWHFJE.txt
TempWRRGP.txt
TempWRRGP.txt
TempWUTXK.txt
TempWVSST.txt
TempWXUDO.txt
TempXDVUQ.bat
TempXDVUQ.txt
TempXDVUQ.txt
TempXFNEC.txt
TempXFNEY.txt
TempXGGPL.txt
TempXGGPL.txt
TempXJRIC.txt
TempXLSBN.txt
TempXNIRI.txt
TempXNIRI.txt
TempXSSHQ.txt
TempYGTSF.txt
TempYLMJR.txt
TempYLMJS.txt
TempYQWIE.txt
TempYVBTX.txt
TempYVEQW.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
memory/1308-2902-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1460-3982-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1760-5327-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2560-4004-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2980-4138-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2984-4639-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3028-5516-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3268-5141-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3668-5609-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3928-3360-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4304-2997-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4372-5486-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4492-5569-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4652-2711-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4692-2962-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4712-3285-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4880-5600-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5112-3668-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5184-3764-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5340-3804-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5380-5341-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5384-4990-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5404-5313-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5440-2560-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5512-5320-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5572-3003-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5604-4878-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-4194-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-2921-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-3567-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-4709-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-5187-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-3780-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-5414-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-2401-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-2402-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-5603-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5720-4924-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5780-3387-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5820-5005-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5872-4651-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5916-4381-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5960-3368-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6016-3138-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6076-5010-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6108-5494-0x0000000000400000-0x0000000000471000-memory.dmp