Analysis
- max time kernel
20s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/09/2026, 22:23
General
- Target ff07c48a99897b4ca0dd6933846f68f84e2ccedf0643a46e85ff965d739e8c8a.exe
- Size 522KB
- Sample260914-2a7dkaaj7z
- SHA256 ff07c48a99897b4ca0dd6933846f68f84e2ccedf0643a46e85ff965d739e8c8a
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 64 IoCs
- Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 30 IoCs
- Adds Run key to start application 2 TTPs 13 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of SetWindowsHookEx 33 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff07c48a99897b4ca0dd6933846f68f84e2ccedf0643a46e85ff965d739e8c8a.exe"C:\Users\Admin\AppData\Local\Temp\ff07c48a99897b4ca0dd6933846f68f84e2ccedf0643a46e85ff965d739e8c8a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PLLXUSWRYNOBGNO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPKAOVEQ\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QUHLHFVTKKMHADE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ORGAXGPFLCTKJUR\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFLCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFLCTKJUR\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEFOKY.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VSRVIMIGWULLNIB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGEJW.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDFRSNLODRYITYI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe" /f6⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYHHSPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QJYIQEDEAFAVQEL\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDEAFAVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDEAFAVQEL\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLGPGE.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SWIGKFNBYCVTCCV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe" /f8⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUJJ.bat" "8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVIOTE.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLXBYGU\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSQAT.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BQROXJPUGDHCKWA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPSHVD.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWBDTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWBDTPQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFNFCO.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWEBPTYFGDMEJX\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYBNKJ.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMVEAYOSYEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\DMVEAYOSYEFCLDI\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHQM.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSINFWNBMC\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYJHLG.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBKBVK.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJOVHHBVCSOYPK\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRFOB.bat" "17⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NKKWSQUPXMNFMNV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMFKYA.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJGPBHMAD\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYNJR.bat" "19⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TCCOUKIMHPEFXVE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe" /f20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "20⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTJUNLOEJXWIQ\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGPL.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMBLB\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDFVJQ.bat" "22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSJHS.bat" "23⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OULJNIQEFYWFFYO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe" /f24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exeC:\Users\Admin\AppData\Local\Temp\GCYQWPFPJHJWXES\service.exe24⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exeC:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPWL.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGHCADYTGNINKVS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSJWSQAVHBVXCSL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVKUKG\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVKUKG\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYLMJS.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UCQPBKBTLHCSLMV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOWOIB.bat" "5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IRJFATXJKHQCINB\service.exe"C:\Users\Admin\AppData\Local\Temp\IRJFATXJKHQCINB\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJIQFEFBGBWREMG\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORGAXGPFKCTKJUR\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVB.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKVLH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNMSOERYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNMSOERYI\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPTFGDMEJYA\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQRWDE.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXLWMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGMTEFSYPXLWMI\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMDYBN.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFDHCKVAXSQTIWE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWANR.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ANJYWMWQORCGMYL\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJYWMWQORCGMYL\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJHLG.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SJTPKTEUETURBMS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MIWVLVONPBFKYXK\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MIWVLVONPBFKYXK\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWVLVONPBFKYXK\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOLTF.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVKYGO.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHOJOK.bat" "19⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWRHVDLCX\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSTQYL.bat" "20⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GYJVUVRPVRHUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GYJVUVRPVRHUCLC\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKHLH.bat" "21⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KTQLUFVAFUVSBNT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKT\service.exe" /f22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKT\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKT\service.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKT\service.exeC:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKT\service.exe22⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exeC:\Users\Admin\AppData\Local\Temp\IVRUXWYKOTABHES\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QIRNIYSDTCSTQLR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJSEK.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPBKBTLHCSLMVYL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe" /f4⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSDWW.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exeC:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe:*:Enabled:Windows Messanger" /f6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJYMT\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f7⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f7⤵
- Modifies registry key
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BKBTLHCVLMJSEKP\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXRKPB.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFLSSDXWLUHGTAX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWFFOK.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WXUDDPVLJNIQEGY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\WOOVKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WOOVKJKGELGWKRA\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNLOEJXWIQ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIIUROTOVKLDKLT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFDHY.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIRDJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHIFN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKQXIJCWADTPQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBHVD.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAXTRAYTJXEN\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPFXVEYNDJBRJHS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTEDHY.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exeC:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQSWUXINSFCRQE\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJXFNE.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHYQMHCBRSPXK\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIQDJ.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVSSA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YVUYLCPLJXOAOQL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXODND\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXODND\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXODND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXODND\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTRAL\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRMCQXG\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLOQVB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKRDDRWOWKULG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IMJJVRPTOWKMELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPQVC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMFKSDDRWOWKVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\SMFKSDDRWOWKVLH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSAGD.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\DLCUMIDWMNLTFLQ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWNLP.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"C:\Users\Admin\AppData\Local\Temp\DQMYPSRTFJOCNWN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHVDR.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IKWWAXSRXTJWENE\service.exe"C:\Users\Admin\AppData\Local\Temp\IKWWAXSRXTJWENE\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAVOUMCNGEHXTUC\service.exe10⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVKKL.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAFDRR\service.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUBPO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUWRPWSHVDLCX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCVV.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CNSOCPAXDVUQREK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAHHQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\OGWFNBBCXCTOBID\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGFTAW.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCWMNKSELP\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWL.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHQHE.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSPJEETURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSPJEETURAA\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXWLU.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOJNUDPT\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYJ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNVHOS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWPVHD.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVREBQ.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YCPFTPNSERTOHLM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWUKVOMPAFKYXJ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "15⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUPSWUXINSFCRQE\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAT.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WONVJJKFEKGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVJJKFEKGWJRA\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGPG.bat" "18⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RWIGKFNBYCVTCCV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe" /f19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCXAMY.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exeC:\Users\Admin\AppData\Local\Temp\FNFWOKFAYPQNVHO\service.exe20⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exeC:\Users\Admin\AppData\Local\Temp\EAWOUMDNGFHYUUC\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBNK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQOWIO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCKC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQD.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMRJRFQG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWVSST.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCRVHIFOAGLB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIVDR.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYMV.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFXWST.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYHDRWHIFOAGLC\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOULJN.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ULAVRMVGWBGVWTC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGEIW.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exeC:\Users\Admin\AppData\Local\Temp\BJBTKHBVLMJSEKP\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exeC:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVPAQP.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TLKSHGHCBHDYTGO\service.exe"C:\Users\Admin\AppData\Local\Temp\TLKSHGHCBHDYTGO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QPTGKGEUSJILGCD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MHWUKUOMPAFKYXJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUA.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NIXVLVPNQBGLYKS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUIPKO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSIVDMDX\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTSH.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exeC:\Users\Admin\AppData\Local\Temp\YQPAXMLMHGMIYLT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIWVH.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEKBSJIT\service.exe"C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEKBSJIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTBPO.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUUVQOVRGUCLC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exeC:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exeC:\Users\Admin\AppData\Local\Temp\RKJRFFGBGCXSFMH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTGKK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exeC:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDXSGN\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exeC:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLULFA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVHIFNGKBM\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQXM.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JWSAVYXLPUBCIAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKNOYT.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVMUJTJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YRLDJQBCPVMUJTJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNWNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNWNSKSGQH\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDRML.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UVJVGFJXYALQXYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBVUJS.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ROCOWCUYTPRDJQQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJHKWAXF\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJHKWAXF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFVSSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSKBLEYDFVSSA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWNNLT.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exeC:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSOERYI\service.exe12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exeC:\Users\Admin\AppData\Local\Temp\NQFYWFYOEJBSJIS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRTYEF.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBIC\service.exe5⤵
-
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exeC:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HMJJURPTOWKLELL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCAJXF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVKYBGPG\service.exe"C:\Users\Admin\AppData\Local\Temp\KMYYCUSBVKYBGPG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXNOLU.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQQRMKRNCQXG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJACDR.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exeC:\Users\Admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLNWSF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYOPM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRQRNLSNDRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRQRNLSNDRYH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEPVMK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYSQTEIOBNV\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYRWPFPJHKWXFS\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMVMRJRFPG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBCQML.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXQCRB.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PLMXUASWRYNOQMH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJGOBH.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJAKDXCEUQ\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYAT.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LQMANYVBTXSOPCH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENEYC.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UGDHDKWAXSQATIW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAGUCQ.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVWSQXSIVDMDX\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBWPVH.bat" "15⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXYALQXYJBDRMLG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HAQHQNICCRSPYKQ\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HAQHQNICCRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAQHQNICCRSPYKQ\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\HAQHQNICCRSPYKQ\service.exeC:\Users\Admin\AppData\Local\Temp\HAQHQNICCRSPYKQ\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exeC:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBEGPL.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BVTRVJNIGXVLLNI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQAQQO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSSTOMTPESAJ\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exeC:\Users\Admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHEMFK.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XENXVFBMGGXQTUG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWSSGP.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"C:\Users\Admin\AppData\Local\Temp\UNMUIHJECJFUIPK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJRDJO.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVKKL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWVXJNSAGDRR\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIQH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTPKFAEUVSB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOYTA.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FERIVRPUGAUWBRK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YRKDJQBCPVMUJTJ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YRKDJQBCPVMUJTJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YRKDJQBCPVMUJTJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQAPQN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exeC:\Users\Admin\AppData\Local\Temp\WPOWKKLGELHXKRA\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exeC:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBFVW\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMIQHF.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFEUUSBB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFEUUSBB\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFEUUSBB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKFEUUSBB\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exeC:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exeC:\Users\Admin\AppData\Local\Temp\SKJRGFGCAHCXSFN\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPGQJHKWAXF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"C:\Users\Admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDXWL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQBYNMNJHOJMUDO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGHEN.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"C:\Users\Admin\AppData\Local\Temp\XARKPWIICWADTPQ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRDJO.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PBJASKGBRKLUXKL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DVOTMCMGEHXTUCP\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVOTMCMGEHXTUCP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVOTMCMGEHXTUCP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCRQLE.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNFKBY\service.exe"C:\Users\Admin\AppData\Local\Temp\FOYGCQVGHFNFKBY\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJKHQ.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exeC:\Users\Admin\AppData\Local\Temp\NGVFNBACWCSNBID\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MIWVLVONPBFKYXK\service.exeC:\Users\Admin\AppData\Local\Temp\MIWVLVONPBFKYXK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLGPG.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYFGD.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLOPUB.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWNVKUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\SMEKRCDQWNVKUKG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUGEI.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HYQMHXQCRBRSPXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGOAHL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"C:\Users\Admin\AppData\Local\Temp\YBSLRYJKDXBEUQR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYVBTX.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROXJP\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXM.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TTGIDBETHOJOKWS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVTCD.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ETURAAMSXIGKFNC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLPKSG.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DXTOCYJEIYWFRXN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exeC:\Users\Admin\AppData\Local\Temp\DRNQTSUGKPCOWOB\service.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exeC:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exeC:\Users\Admin\AppData\Local\Temp\WQJPWHIBVCSOPLK\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exeC:\Users\Admin\AppData\Local\Temp\PSICYAHQGMEUMAK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCVV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exeC:\Users\Admin\AppData\Local\Temp\YQPAXMLMIGNIYLT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exeC:\Users\Admin\AppData\Local\Temp\WOIBGOXNSKSGRHD\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJEDSTQAL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exeC:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLDX\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCWV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYLT\service.exe"C:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYLT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYLT\service.exeC:\Users\Admin\AppData\Local\Temp\YQQAXMLMIGNIYLT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVOTMCMGEHXTUCP\service.exeC:\Users\Admin\AppData\Local\Temp\DVOTMCMGEHXTUCP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFOFKCTKIT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVRRGP.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTPCO.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWANDRNLQCPSNGJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SENEWNKFVOPYOPM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIPTFD.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRHSLJMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRHSLJMYCHVUG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVBTXS.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLUDXNSXDEBKCHW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLUDXNSXDEBKCHW\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MROCOWCUYTPQDJQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRC.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RDLDVMJDTNOXNOL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVHOS.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exeC:\Users\Admin\AppData\Local\Temp\HAPHQNHCBRSPYKQ\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exeC:\Users\Admin\AppData\Local\Temp\UNMUIIJECJFVIPK\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRKDJQBCPVMUJTJ\service.exeC:\Users\Admin\AppData\Local\Temp\YRKDJQBCPVMUJTJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGAOX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exeC:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTAON.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WAXLXIHLCMSLBBD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGE.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBRAISOJDDSTQLR\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGHRN.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XVTXLBOKIXNANPK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWNCMC\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWNCMC\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBQYPJ.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FSOMRERTOHKLVQE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXJGKF.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"C:\Users\Admin\AppData\Local\Temp\MIWULVONPBFKYXJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHYUUV.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TSEMEWNKEUOPYOP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDRQCL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQGRKILXBYGU\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMTXJH.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YKSKTPKTFUEUVSB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSHVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSHVDMDX\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCGHQM.bat" "12⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WUTXKAOKHYWMMOJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exe" /f13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYXTU.bat" "13⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OPLJLBOWFQVGSDC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOLUG.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exeC:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCWRFMH\service.exe15⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exeC:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISN.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exeC:\Users\Admin\AppData\Local\Temp\SVLEDKTJPGXODND\service.exe4⤵
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exeC:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exeC:\Users\Admin\AppData\Local\Temp\HDRXPGQJIKXAXFT\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exeC:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPCIN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKBLEYCFVRSA\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exeC:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exeC:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\GPGYPMHBBQROXJP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTMPQV.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exeC:\Users\Admin\AppData\Local\Temp\LETDLAUARLGBGVW\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWNCMC\service.exeC:\Users\Admin\AppData\Local\Temp\RUKECJSIOGWNCMC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXKJWD.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HTEDHYUVIOVVGAO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACESA.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQFTBK\service.exe"C:\Users\Admin\AppData\Local\Temp\YFXHTTUPNUQFTBK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJWHGK.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CAEGSTONPFSAJAU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exeC:\Users\Admin\AppData\Local\Temp\XPPXLKLHFMHXLSB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exeC:\Users\Admin\AppData\Local\Temp\CPLYOYRQSEINBMV\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDTCKUQLFAFUVSB\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exeC:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJVWES\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCIWES.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EPMLPCGCAQWOFFH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HWXVDEPVMKOJRFG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNXSA.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"C:\Users\Admin\AppData\Local\Temp\XQKCIPYABOULTIS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDQBYE.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYAYMNIGJMTDOT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFFY.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exeC:\Users\Admin\AppData\Local\Temp\CLCUMIDWMNKTFLQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQYKRV.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XWIQHRNIYRDSCST" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDTCKTQLFAFUVSB\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exeC:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTIRED.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXQVOEOIGIVWER\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXMIRI.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BNTYKHLGODEWUDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe"C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFFYOK.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exeC:\Users\Admin\AppData\Local\Temp\MEUELAAVBRMHBGW\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exeC:\Users\Admin\AppData\Local\Temp\JMYXBUSBUKYAGOF\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exeC:\Users\Admin\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQVGEI.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HYQMHXRCRBRSPXK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRVQYM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXSBVXLQVBCIAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGPGD.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIROIDDSTQLR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IHVCLUSDXKDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKWH.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JWDMWUEALEYFVOS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSENEI.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNCIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNCIWVHP\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNCIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KFUSISMKNCIWVHP\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LODWUDWMCIQHGRO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUASWR.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQWCDAJB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKLJR.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUPCJE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempREBQY.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BJBTKHCVLMJSEKP\service.exe"C:\Users\Admin\AppData\Local\Temp\BJBTKHCVLMJSEKP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGOGD.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WHFJEMBYCUSBBVK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exeC:\Users\Admin\AppData\Local\Temp\KDSCKTQLFAFUVSB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRKNOX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"C:\Users\Admin\AppData\Local\Temp\PHXHODCDYEUPCKE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQSIW.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AQROWIPTFDHCKVX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\VXNHAFMWMRJRFPG\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMRKAKEYCFVRSA\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exeC:\Users\Admin\AppData\Local\Temp\KGUSJTMKNDIWVHP\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVGFJW.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCTLHCVMNKSELP\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCTLHCVMNKSELP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGEI.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GYQMHXQBRBQROXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHJSO.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exeC:\Users\Admin\AppData\Local\Temp\SVLFDKTKPHYPDNE\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exeC:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exeC:\Users\Admin\AppData\Local\Temp\RTJDBISINFWNBMC\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exeC:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exeC:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exeC:\Users\Admin\AppData\Local\Temp\JFTSISMKMCHVUHP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESXIJHPBHMAD\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exeC:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQLR\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exeC:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exeC:\Users\Admin\AppData\Local\Temp\VPINVGGAUBRNYOK\service.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempACESA.txt
TempACESA.txt
TempAGUCQ.txt
TempAHVDR.txt
TempBCQML.txt
TempBDRML.txt
TempBEGPL.txt
TempBIVDR.txt
TempBKBVK.txt
TempBQYPJ.txt
TempBVUJS.txt
TempBWPVH.txt
TempCAJXF.txt
TempCFGPL.txt
TempCGHQM.txt
TempCIWES.txt
TempCRQLE.txt
TempCXAMY.txt
TempDFVJQ.txt
TempDGHQM.txt
TempDGHRN.txt
TempDQBYE.txt
TempDRQCL.txt
TempDVTCD.txt
TempDWWLU.txt
TempDXBNK.txt
TempDXWLU.txt
TempEFOKY.txt
TempEHIRN.txt
TempEHIRN.txt
TempEHISN.txt
TempEHJSO.txt
TempENEYC.txt
TempEPVMK.txt
TempFFYOK.txt
TempFNFCO.txt
TempFOKYX.txt
TempFTAON.txt
TempFTBPO.txt
TempFTBPO.txt
TempFXWST.txt
TempFYNJR.txt
TempFYOJS.txt
TempFYYMV.txt
TempGAOXK.txt
TempGBHVD.txt
TempGFTAW.txt
TempGHENF.txt
TempGOAHL.txt
TempGUBPO.bat
TempGUCQP.txt
TempGUCQP.txt
TempGYXTU.txt
TempHEMFK.txt
TempHIRMV.txt
TempHOJOK.txt
TempHPCIN.txt
TempHYUUV.txt
TempIACQM.txt
TempIACQM.txt
TempIPTFD.txt
TempIRDJO.txt
TempJACDR.txt
TempJGOBH.txt
TempJHLGO.txt
TempJLUQD.txt
TempJRDJO.txt
TempJSJHS.txt
TempJSOWN.txt
TempJWHGK.txt
TempJXFNE.txt
TempKHQCI.txt
TempKHQCI.txt
TempKLUQD.txt
TempKNOYT.txt
TempKTFLQ.txt
TempKTPCO.txt
TempLGPGE.txt
TempLHQHE.txt
TempLIQDJ.txt
TempLNWSF.txt
TempLOPUB.txt
TempLOQVB.txt
TempLPKSG.txt
TempLPQVB.txt
TempLPQVC.txt
TempLULFA.txt
TempLYGPG.txt
TempMDYBN.txt
TempMFKYA.txt
TempMIQHF.txt
TempMIWVH.txt
TempMIWVH.txt
TempMIWVH.txt
TempMJRDK.txt
TempMJSEK.txt
TempMNXSA.txt
TempMTXJH.txt
TempMVHNS.txt
TempMVREB.txt
TempNJXWI.txt
TempNJXWI.txt
TempNOLTF.txt
TempNOLUG.txt
TempNOYTA.txt
TempNVHOS.txt
TempNVKKL.txt
TempNVKKL.txt
TempOPYAT.txt
TempOPYUA.txt
TempOPYUB.txt
TempOULJN.txt
TempOWOIB.txt
TempOXTSH.txt
TempPPYAT.txt
TempPPYAU.txt
TempPPYAU.txt
TempPSHVD.txt
TempPTGKK.txt
TempPTOWL.txt
TempPUGEI.txt
TempPUGEI.txt
TempPXODM.txt
TempPYOPM.txt
TempPYPEN.txt
TempQAPQN.txt
TempQAQQO.txt
TempQBVUJ.txt
TempQBVUJ.txt
TempQRWDE.txt
TempQSXDE.txt
TempQUGEI.txt
TempQUPWL.txt
TempQUPXM.txt
TempQVGEI.txt
TempQWNLP.txt
TempQYKRV.txt
TempREBQY.txt
TempRKNOX.txt
TempRMUJJ.txt
TempRRCVV.txt
TempRRCVV.txt
TempRRCWV.txt
TempRRFOB.txt
TempRSDWW.txt
TempRSXEF.txt
TempRTYEF.txt
TempRVQXM.txt
TempRVQYM.txt
TempSDXWL.txt
TempSENEI.txt
TempSQSIW.txt
TempSQUPX.txt
TempSTQYL.txt
TempTEDHY.txt
TempTFDHY.txt
TempTIRED.txt
TempTMPQV.txt
TempTYFGD.txt
TempTYKWH.txt
TempUASWR.txt
TempUASWR.txt
TempUGEIW.txt
TempUGMRC.txt
TempUGMRD.txt
TempUGMRD.txt
TempUIPKO.txt
TempUQYPE.txt
TempUQYPE.txt
TempUQYPE.txt
TempVBTXS.txt
TempVGAOX.txt
TempVGEJW.txt
TempVGFJW.txt
TempVGHEN.txt
TempVHFJE.txt
TempVHIFN.txt
TempVHNSE.txt
TempVHNSE.txt
TempVIOTE.txt
TempVJKKT.txt
TempVKYGO.txt
TempVLGPG.txt
TempVPAQP.txt
TempVREBQ.txt
TempVRRGP.txt
TempWALYJ.txt
TempWFFOK.txt
TempWHFJE.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIGKF.txt
TempWIOTF.txt
TempWNNLT.txt
TempWPVHD.txt
TempWRRGP.txt
TempWSAGD.txt
TempWSSGP.txt
TempWVSST.txt
TempXAMYJ.bat
TempXDVUQ.txt
TempXGGPK.txt
TempXGGPL.txt
TempXJGKF.txt
TempXJHLG.txt
TempXJKHQ.txt
TempXKJWD.txt
TempXMIQH.txt
TempXMIRI.txt
TempXNOLU.txt
TempXQCRB.txt
TempXRKPB.txt
TempXSQAT.txt
TempXSSHQ.txt
TempXWANR.txt
TempYAHHQ.txt
TempYBNKJ.txt
TempYGOGD.txt
TempYGPGD.txt
TempYGPGE.txt
TempYJHLG.txt
TempYKHLH.txt
TempYKLJR.txt
TempYLMJS.txt
TempYVBTX.txt
TempYWFFY.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.txt
service.exe
service.exe
service.exe
service.exe
memory/736-2385-0x0000000000400000-0x0000000000471000-memory.dmp
memory/772-1927-0x0000000000400000-0x0000000000471000-memory.dmp
memory/988-4573-0x0000000000400000-0x0000000000471000-memory.dmp
memory/992-3964-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1032-2028-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1148-4481-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1356-1549-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1392-4872-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1628-1970-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1884-5111-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1884-5437-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2176-3199-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2236-5463-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2412-2090-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2544-4364-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2788-3603-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3160-1170-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3184-947-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3264-5464-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3280-3848-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3476-3927-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3524-3369-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4100-2821-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-3557-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-5196-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-5475-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-1665-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-497-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-4588-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-495-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-2215-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-1085-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-2593-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-3050-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-4259-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-4844-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-3971-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4136-5322-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4328-5101-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4360-2783-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4376-4268-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4428-2107-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4504-4355-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4748-4827-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4808-3256-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5020-4450-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5096-5446-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5272-3711-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5308-4673-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5316-3663-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5368-3881-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5408-3007-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5432-5422-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5432-4558-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5480-5331-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5532-3033-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5648-3308-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5664-3720-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5676-4727-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5768-4452-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5776-3006-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5988-5133-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6024-4182-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6036-4644-0x0000000000400000-0x0000000000471000-memory.dmp