Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 13:29
General
- Target 84ee9c2c8938051ee6660d4e041415325654250ea8dda39e78af7f7f80aba309.exe
- Size 522KB
- Sample260916-qrakdavy4p
- SHA256 84ee9c2c8938051ee6660d4e041415325654250ea8dda39e78af7f7f80aba309
Score
10/10
Malware Config
Signatures
- Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades payload 50 IoCs
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 18 IoCs
- Adds Run key to start application 2 TTPs 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84ee9c2c8938051ee6660d4e041415325654250ea8dda39e78af7f7f80aba309.exe"C:\Users\Admin\AppData\Local\Temp\84ee9c2c8938051ee6660d4e041415325654250ea8dda39e78af7f7f80aba309.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHUBYY.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FXWSTGMTTEXXMVI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKXTCWYMQVCDAJB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BYMKINAEAOUMCCE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSIVDMDX\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSIVDMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HJVVWRPWSIVDMDX\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWWLU.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TPDQBYEWVRSFLSS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"C:\Users\Admin\AppData\Local\Temp\RQAYMMNIGNJMTDO\service.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMREH.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FNCDVTCDWLHQHFQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe" /f6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVMWPOQCGLYKS\service.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXODM.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LIITQOSNVJKDKKT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMG\service.exe" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGBWRFMG\service.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUGEI.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HYQMHXQCRBRSPXJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe" /f8⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSITMKNDIWVHP\service.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNVJJK.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FABWRELGLYITQOS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNJXWI.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RPUHLHEVTJJLGDE" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe" /f10⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJLUQD.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BYWAOESNLQDQSNG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe" /f11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLNWSF.bat" "11⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOXAAOTLTHR\service.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWIGK.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDVMJDXNOLUGMR\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exeC:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe14⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f16⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe:*:Enabled:Windows Messanger" /f15⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOFXPLGAAPQNWIO\service.exe:*:Enabled:Windows Messanger" /f16⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f15⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f16⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f16⤵
- Modifies registry key
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exeC:\Users\Admin\AppData\Local\Temp\GTPSVUWIMRFCQQE\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGHENF.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KYFOXVFCNGHXQTU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe"C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAHHQM.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYWFFRXNLPKSHIY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHUCLCW\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHUCLCW\service.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAACDR.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AUWKWHGKXBLRYYJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYKIMH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exe"C:\Users\Admin\AppData\Local\Temp\AOJYWMWQORCHMLT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFKX.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CLCULIDWMNKTFLQ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIREDR.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VBTXSOQCIPPYAUT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJABDR.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"C:\Users\Admin\AppData\Local\Temp\XEWHTSTPNUPFSAJ\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRQFOB.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCXCTOBID\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQCVVJ.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMIXLSB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPRWC.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMI\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMI\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJWSAVYXLPUBCIA\service.exe"C:\Users\Admin\AppData\Local\Temp\AJWSAVYXLPUBCIA\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXFNEC.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHCBRSPXJQ\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRDYC.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPMVHN\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFAYOPMVHN\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQSXDE.bat" "16⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IIVCLUSDXKDXEUN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe" /f17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOBHMC.bat" "17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVLH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVLH\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSDWWL.bat" "18⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "19⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTHHIDCIEUHOJ\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTBPOA.bat" "20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVUVRPWRHVCLCW\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDLF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDLF\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDWUDD.bat" "22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ETUSABMTXJHLGOC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\VNNUJIJFDKFVIQK\service.exe" /f23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VNNUJIJFDKFVIQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNNUJIJFDKFVIQK\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMADDC.bat" "23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exe"C:\Users\Admin\AppData\Local\Temp\GTPSWUXIMSFCRQE\service.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAPQNW.bat" "24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exeC:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHS\service.exe25⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exeC:\Users\Admin\AppData\Local\Temp\OQGAYWFPFKCTKIT\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MSXJHLGOCDWUDDW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBVUJ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYYNW.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRPSDINAMU\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYAUTI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTB\service.exe"C:\Users\Admin\AppData\Local\Temp\CUMSLBLFYDFWSTB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEIJSO.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TVLFDKUKPHYPDNE\service.exe"C:\Users\Admin\AppData\Local\Temp\TVLFDKUKPHYPDNE\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exeC:\Users\Admin\AppData\Local\Temp\MPEXVEXNDIARIHS\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exeC:\Users\Admin\AppData\Local\Temp\XRJPWHIBVACSPPL\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMYUAS.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CHVVIKFDGVJQLPA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFTAON.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVRGUCKB\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIVDR.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWAYTRAYUJXFN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWALYJ.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ECGBIUVQPRHUCLC" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIYVVD\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETURAB\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCJXFS.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOF\service.exe"C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGOF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCUYTQ.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDLEIX\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTSUPNUPFTBJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPK.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NFVEMBABWBSNAIC\service.exe"C:\Users\Admin\AppData\Local\Temp\NFVEMBABWBSNAIC\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXCUYT.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "XLMHFIYLSBNSCOA" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVHNS.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPGQJIKWAXF\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIKTPC.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYVVD\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGYWFF.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRNLSNDQYH\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "7⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IVCMVTDAYKEYFVO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYNXNJ\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYNXNJ\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRRCWV.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe"C:\Users\Admin\AppData\Local\Temp\YRQAYMLNIGNJYMT\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVVPIN.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"C:\Users\Admin\AppData\Local\Temp\KFUSISMKNDIWVHP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPYLK.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"C:\Users\Admin\AppData\Local\Temp\VCUFRQRMLRNDQYH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTYKIM.bat" "11⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TKUQLUFVAFUVSCN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe"C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCFGQM.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJDBIRHNFVMBLB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHPBIM.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKALEYCFVRSA\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYAT.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJJKFDKGWJQA\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDGIRN.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SUKECJSJOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\SUKECJSJOGXOCMD\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHIRN.bat" "16⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJOGXOCND\service.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempASWRN.bat" "17⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VIKFDFVJQLPAMXU" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe" /f18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJKGELGWKRA\service.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMV.bat" "20⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UQERCAFXWSTGMTT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe" /f21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDESAO.bat" "21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"C:\Users\Admin\AppData\Local\Temp\FYIUTVQOVQGUCKB\service.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFOKYX.bat" "22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHBXGPGLDULJAU\service.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIGKF.bat" "23⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exeC:\Users\Admin\AppData\Local\Temp\LHVUKUNMOAEJXWJ\service.exe24⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exeC:\Users\Admin\AppData\Local\Temp\OHWGOCBDXDTOCJE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWRRGP.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHHIDBIEUHOJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVJKKT.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GBBWRFMHLITQOSN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSFCRRE\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSFCRRE\service.exe"C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSFCRRE\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEXXMU.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNMOJHOKNUDPT\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKVSQU.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEJQCCQVNVJTKG\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPKDHI.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RJJQFEFBGBWREMG\service.exe"C:\Users\Admin\AppData\Local\Temp\RJJQFEFBGBWREMG\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\RJJQFEFBGBWREMG\service.exeC:\Users\Admin\AppData\Local\Temp\RJJQFEFBGBWREMG\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exeC:\Users\Admin\AppData\Local\Temp\UXNHAFMVMRJRFPG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFTS.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYDVTCWLBHPGFQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKTFLQ.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RQCKCTLHCSMNWMN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"C:\Users\Admin\AppData\Local\Temp\WOIBHOXANSKSGRH\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBIVDR.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXWBYTRAYUJXFN\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQBUUJ.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"C:\Users\Admin\AppData\Local\Temp\XPOWLKLGFLHXKSB\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGUT.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LODWUDWMCHQHGRO\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\VYOIAGNWMSKSGQH\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQLL.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"C:\Users\Admin\AppData\Local\Temp\WCVFRRSNLSODRYH\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMJRDK.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EAVOTMCMGEHXTUC\service.exe"C:\Users\Admin\AppData\Local\Temp\EAVOTMCMGEHXTUC\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOVKKL.bat" "11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FGBCXSFMHMIURPT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe" /f12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYJKHQ.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHNUFGTYAQYMXN\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNQRWD.bat" "13⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CTMRYKAKEYCFVRS\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMRYKAKEYCFVRS\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXXMVI.bat" "14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKNUEPU\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDVUCD.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exeC:\Users\Admin\AppData\Local\Temp\YEXHTTUPNUQFTBJ\service.exe16⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exeC:\Users\Admin\AppData\Local\Temp\ENEWOKFYOPMVHNS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSYEF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPHNUFGTARYNXNJ\service.exe"C:\Users\Admin\AppData\Local\Temp\VPHNUFGTARYNXNJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEYXMV.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"C:\Users\Admin\AppData\Local\Temp\TSCONPKIPLAOVEQ\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNGJKT.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"C:\Users\Admin\AppData\Local\Temp\TMLTHGIDBIETHOJ\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSTYEF.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPINUGGAUBRNXOK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYIPEDEAFAVQDL\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXBBY.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"C:\Users\Admin\AppData\Local\Temp\GPYGDRVHIFOAGLB\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "8⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUSJTMLNDIWVHQ\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWCUYT.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WWKLGEHXKRBMRBO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGSDCG.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"C:\Users\Admin\AppData\Local\Temp\CTMSKBLEYDFVRSA\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJQLPA.bat" "11⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTJCBIRHNEVMBLB\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKIMHP.bat" "13⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UQLUFVAFUVSCNTY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe" /f14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVUWIMRECQYQ\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTOXOD.bat" "14⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"C:\Users\Admin\AppData\Local\Temp\QJIQEEFAFBWRELG\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJPUFD.bat" "15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OGXPLGWQBRAQROX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe" /f16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIOTFD.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exeC:\Users\Admin\AppData\Local\Temp\CLVDYOSXEFCKDIW\service.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GUQTWUXINSFCRRE\service.exeC:\Users\Admin\AppData\Local\Temp\GUQTWUXINSFCRRE\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUQYPE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHCXSGN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKHQCI.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe"C:\Users\Admin\AppData\Local\Temp\CUNSLBLFDGWSTBO\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempHIRMV.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHXGOCCDYDUPCJE\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXDVUQ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exeC:\Users\Admin\AppData\Local\Temp\ENWFBPUFGDMEJYA\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exeC:\Users\Admin\AppData\Local\Temp\AIARJFAUYKLIQCJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKYGOF.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"C:\Users\Admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDL.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBRNYOK\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPPYAU.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "LQNBNYVBTXSOPCI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempACQML.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNMSOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNMSOERIT\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNOXTA.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"C:\Users\Admin\AppData\Local\Temp\YQKDJQBCPVMUITJ\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYPEN.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDX\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDX\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGUT.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NREIECSYQHHJEAB" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJHLGO.bat" "9⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"C:\Users\Admin\AppData\Local\Temp\NJXVLWPNQBGLYKS\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKXFTS.bat" "10⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLBHPGFQ\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPRWC.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVMH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVMH\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exeC:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe13⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exeC:\Users\Admin\AppData\Local\Temp\FBWPVNEOHGIYUVD\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOMQLS.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQTSUGKPDAOXO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOPYUB.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"C:\Users\Admin\AppData\Local\Temp\RLEKRCDQWNVJUKG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGBOXK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"C:\Users\Admin\AppData\Local\Temp\VBUEQPRMKRNCQXG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBFGPL.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QSICYAHRHMEVMAK\service.exe"C:\Users\Admin\AppData\Local\Temp\QSICYAHRHMEVMAK\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSQUPX.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAUYWKPUABHAE\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKCGUL.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\ENXFCQUGHENFKYA\service.exe"C:\Users\Admin\AppData\Local\Temp\ENXFCQUGHENFKYA\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOXTAG.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FERHVROTGTVAQJM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMTII.bat" "9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FSORUTVHLQEBPYP\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMPRWC.bat" "10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GUBKYTRCWJCWYDT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVMH\service.exe" /f11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"C:\Users\Admin\AppData\Local\Temp\TNGLSEESXPXLVMH\service.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEWUDD.bat" "11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"C:\Users\Admin\AppData\Local\Temp\VONVJIKFDKGVJQL\service.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHNSE.bat" "12⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYTCWYMRWCDAJB\service.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPUGDH.bat" "13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"C:\Users\Admin\AppData\Local\Temp\JFTRISLKMCHVUGO\service.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMVREB.bat" "14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DXCPFTPMRERTOHL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe" /f15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSA.bat" "15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOULTHS\service.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLIQC.bat" "16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exeC:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exeC:\Users\Admin\AppData\Local\Temp\DMWEAPTYFGDMEJX\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPDDEEAVQDKF\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exeC:\Users\Admin\AppData\Local\Temp\WONVKJKGELGWJRA\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGRXOM.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLUGMR\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYNXNJ\service.exeC:\Users\Admin\AppData\Local\Temp\UOHNUFGTAQYNXNJ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXAMYK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNFXOLFAPQNWIOT\service.exe"C:\Users\Admin\AppData\Local\Temp\FNFXOLFAPQNWIOT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBDRML.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exeC:\Users\Admin\AppData\Local\Temp\XDWGSRTOMTPESAI\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exeC:\Users\Admin\AppData\Local\Temp\HUQTWVXJNSAGDRR\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"C:\Users\Admin\AppData\Local\Temp\KGUTJTMLNDIWVHQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDPVMK.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"C:\Users\Admin\AppData\Local\Temp\CPLXOYRQSEINBMV\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKWHGK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTGMR\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTGMR\service.exeC:\Users\Admin\AppData\Local\Temp\DLDUMIDXNOLTGMR\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exeC:\Users\Admin\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\GCYQWPFPIHJWXES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCYQWPFPIHJWXES\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXL.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"C:\Users\Admin\AppData\Local\Temp\IWRAUYWKPUABHET\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOJXWI.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ORHAXGPFLCTKJUR\service.exe"C:\Users\Admin\AppData\Local\Temp\ORHAXGPFLCTKJUR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYWFGO.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSNAHC\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMAABVBSNAHC\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUEPVM.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"C:\Users\Admin\AppData\Local\Temp\HVRUXWYKOTABGES\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempSRATJ.bat" "7⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exeC:\Users\Admin\AppData\Local\Temp\MFUEMABVBRMAHCG\service.exe8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exeC:\Users\Admin\AppData\Local\Temp\CMVDAYOSXEFCLDI\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWHFJE.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"C:\Users\Admin\AppData\Local\Temp\LHVTKUNMOAEJXWI\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRSXEF.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"C:\Users\Admin\AppData\Local\Temp\UOHMUFFTYAQYMXN\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBMK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\FOFXPLGAAPQNWIO\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRMUIJ.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FTORVTWHMREBQYP\service.exe"C:\Users\Admin\AppData\Local\Temp\FTORVTWHMREBQYP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPCINA.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NHQYIEPJKTWXJKH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPKDGH.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSOWN.bat" "8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFBVQEL\service.exe"C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFBVQEL\service.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGKFNB.bat" "9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SOJTEUDTURAMSXI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe" /f10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLYGPG.bat" "10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exe"C:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exeC:\Users\Admin\AppData\Local\Temp\JBRAISOJDDSTQAL\service.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exeC:\Users\Admin\AppData\Local\Temp\SVKEDKTJPGXOCND\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJQKPA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"C:\Users\Admin\AppData\Local\Temp\QTICBIRHMEVMALB\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"C:\Users\Admin\AppData\Local\Temp\PSHBYAHQGMDULKA\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXWTTU.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCN\service.exe"C:\Users\Admin\AppData\Local\Temp\GPHDSWIJGOBHMCN\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKIMHP.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exeC:\Users\Admin\AppData\Local\Temp\FTPSVTWHMREBQYQ\service.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exeC:\Users\Admin\AppData\Local\Temp\UOHMTFFTYAQYMWN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVHFJX.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"C:\Users\Admin\AppData\Local\Temp\CKCULICWMNKTFLQ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQUPXM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"C:\Users\Admin\AppData\Local\Temp\IWSAVYXLPUBCHAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMHQHF.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exeC:\Users\Admin\AppData\Local\Temp\KCSBJTPKFETUSAB\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exeC:\Users\Admin\AppData\Local\Temp\ANJXWMWQOQCGLYL\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGHPL.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NGWFNBBCWCTOBID\service.exe"C:\Users\Admin\AppData\Local\Temp\NGWFNBBCWCTOBID\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempURVQY.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBWYMQVCDAIB\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMNWSF.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCHOYAAOTLTHR\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLIRDJ.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGXTTBP\service.exe"C:\Users\Admin\AppData\Local\Temp\DVNTLCMFEGXTTBP\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGAOXK.bat" "6⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RWSGSECGYUVINUV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPQNWI.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"C:\Users\Admin\AppData\Local\Temp\XPJCIPYABOTLTHS\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTCNUK.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MLTLAUQLUGVBFVW" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe"C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exeC:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVMH\service.exeC:\Users\Admin\AppData\Local\Temp\TNFLSEERXPXLVMH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTUGHE.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exeC:\Users\Admin\AppData\Local\Temp\WDVGSRSOMTOERIT\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exeC:\Users\Admin\AppData\Local\Temp\WYOIBGNXNSKSGQH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXBNK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe"C:\Users\Admin\AppData\Local\Temp\GOFXPLGBAPQNWIO\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCPO.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLCX\service.exe"C:\Users\Admin\AppData\Local\Temp\GJVVWRPWSHVDLCX\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPYAUT.bat" "4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MQNBNVBTXSOQCIP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe" /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe"C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempRPSHV.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"C:\Users\Admin\AppData\Local\Temp\WPOWKJLGELGWKRA\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVLXIH.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"C:\Users\Admin\AppData\Local\Temp\EMDVNJEXNOLUGMR\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempAJXFT.bat" "7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"C:\Users\Admin\AppData\Local\Temp\KNYCVTCVLYBGPGF\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJRDKO.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PBJASKGBRKLUYKL" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exeC:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exeC:\Users\Admin\AppData\Local\Temp\HDSXQGQKILXAYGT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXTAGD.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exeC:\Users\Admin\AppData\Local\Temp\VPIOVGHAUBROYOK\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exeC:\Users\Admin\AppData\Local\Temp\HQIESWIJGPBHMAC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQNWIO.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMYVUY.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QOSNVJKDKKTOXOD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQMLTK.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"C:\Users\Admin\AppData\Local\Temp\FNEWOKFYOPMVHNS\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUGMRD.bat" "5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"C:\Users\Admin\AppData\Local\Temp\GCXQWOFPIHJWWES\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQWMKO.bat" "6⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exeC:\Users\Admin\AppData\Local\Temp\CQMYPSQTEJOBNVN\service.exe7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRXPFQJHKWAXF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJSNWN.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FKYGHSPNRMUIJCJ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exeC:\Users\Admin\AppData\Local\Temp\QIYHPEDEAFAVQDL\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exeC:\Users\Admin\AppData\Local\Temp\JFTRISLKMYCHVUG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempLHVUG.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exeC:\Users\Admin\AppData\Local\Temp\MOEWUDXNDIARIGR\service.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VNNUJIJFDKFVIQK\service.exeC:\Users\Admin\AppData\Local\Temp\VNNUJIJFDKFVIQK\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCLHVU.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"C:\Users\Admin\AppData\Local\Temp\LDTCKUAQLGAFVVT\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVUHPG.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SGJFDTSIIKFBCMH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXSSHQ.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDJFVIQK\service.exe"C:\Users\Admin\AppData\Local\Temp\VNMUJIJFDJFVIQK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIRNVM.bat" "5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"C:\Users\Admin\AppData\Local\Temp\PIXHPDCEYEUPDKF\service.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVXCSL.bat" "6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"C:\Users\Admin\AppData\Local\Temp\ILXXBYTRAYUJXFN\service.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPTOWK.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SFHCACXSGNHMJUR" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe" /f8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYPNRM.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PYPDEAVQDKFKXHS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe" /f9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe9⤵
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBJCH\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exeC:\Users\Admin\AppData\Local\Temp\RUJDCJSIOFWNCMC\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPXPEM.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCXRFMH\service.exe"C:\Users\Admin\AppData\Local\Temp\RKJRFEGBGCXRFMH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGUCQP.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"C:\Users\Admin\AppData\Local\Temp\HKWVXSQXSIWEMDY\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVIOTE.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exeC:\Users\Admin\AppData\Local\Temp\IESYQHRKILXBYGU\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exeC:\Users\Admin\AppData\Local\Temp\SRBNNOJHOKANUEP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exeC:\Users\Admin\AppData\Local\Temp\UBTDPPQLKQMCPWG\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempESAJA.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"C:\Users\Admin\AppData\Local\Temp\UMLTIHIECJEUHPJ\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIACQM.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exeC:\Users\Admin\AppData\Local\Temp\WDVFRRSNLSODRYI\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exeC:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exeC:\Users\Admin\AppData\Local\Temp\GOGXPLGBAQROWIP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exeC:\Users\Admin\AppData\Local\Temp\ERNQUSVGKQDAPXO\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMUGNR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"C:\Users\Admin\AppData\Local\Temp\HDYRWPFPJHKWAXF\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMBKWT.bat" "3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIVVDR\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIVVDR\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIVVDR\service.exeC:\Users\Admin\AppData\Local\Temp\FBXPVNEOHGIVVDR\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exeC:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exeC:\Users\Admin\AppData\Local\Temp\DNWEBPTYFGDMEJX\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exeC:\Users\Admin\AppData\Local\Temp\EVOTMCMGEHXTUCQ\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUCPOB.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "YMYKIMADOTMCCEG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"C:\Users\Admin\AppData\Local\Temp\RUKECJSIOGXOCMD\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDXWLU.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QEQBAYEWVRSFLSS" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe"C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exeC:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exeC:\Users\Admin\AppData\Local\Temp\EMEVNJEYOPMUGNS\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempGXGGP.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CHWXUDEPVMKOJRF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe"C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempVASWS.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "VVJKFDGWJQLQAMY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTFLQC.bat" "4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\FBXPVOEOIGIVWDR\service.exe"C:\Users\Admin\AppData\Local\Temp\FBXPVOEOIGIVWDR\service.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exeC:\Users\Admin\AppData\Local\Temp\SLKSGFHCAHDYSGN\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTPNRM.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "QYQDFAAVQELGKYH" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempKLUQE.bat" "3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"C:\Users\Admin\AppData\Local\Temp\VYNHAGNWMSJRFQG\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempOAHLC.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WPIOVGHAUBROYOK\service.exe"C:\Users\Admin\AppData\Local\Temp\WPIOVGHAUBROYOK\service.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempEHISN.bat" "5⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exeC:\Users\Admin\AppData\Local\Temp\RRBNMNJHOJNUDOT\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIUFEI.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "PACFQSNLODRYHTY" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWTCNU.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CHMLTLUQLUGVAFV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempDYRXJ.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCIAF\service.exe"C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCIAF\service.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCIAF\service.exeC:\Users\Admin\AppData\Local\Temp\AJXTBVXLQVBCIAF\service.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\BKYUCXNRWDEBKCH\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBPWFR.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"C:\Users\Admin\AppData\Local\Temp\OHWGOCCDXDUOCJE\service.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPESAI.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WMNKSELQBDGRTOM" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe"C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempWIOTF.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IESYRHRLJLYBGUT\service.exe"C:\Users\Admin\AppData\Local\Temp\IESYRHRLJLYBGUT\service.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exeC:\Users\Admin\AppData\Local\Temp\CLYUDXNRXDEBKCH\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exeC:\Users\Admin\AppData\Local\Temp\HPGYQMHBBQROXJP\service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exeC:\Users\Admin\AppData\Local\Temp\UATDPPQLJQMBPWF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempBKBVK.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"C:\Users\Admin\AppData\Local\Temp\JCRBJSOJEDTURAA\service.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exeC:\Users\Admin\AppData\Local\Temp\JLXXBYTRAYUJXAF\service.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempMEYBN.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TempAACDR.txt
TempACQLL.txt
TempACQML.txt
TempAHHQM.txt
TempAJXFT.txt
TempAJXFT.txt
TempAPQNW.txt
TempASWRN.txt
TempBDRML.txt
TempBFGPL.txt
TempBIVDR.txt
TempBIVDR.txt
TempBKBVK.txt
TempBPWFR.txt
TempBPYLK.txt
TempCFGQM.txt
TempCJXFS.txt
TempCLHVU.txt
TempCUYTQ.txt
TempDESAO.txt
TempDGIRN.txt
TempDPVMK.txt
TempDVUCD.txt
TempDWUDD.txt
TempDWWLU.txt
TempDXBMK.txt
TempDXBMK.txt
TempDXBNK.txt
TempDXWLU.txt
TempDYRXJ.txt
TempEHIRN.txt
TempEHISN.txt
TempEIJSO.txt
TempESAJA.txt
TempEWUDD.txt
TempEXXMU.txt
TempEXXMV.txt
TempEYXMV.txt
TempFOKYX.txt
TempFTAON.txt
TempFYYNW.txt
TempGAOXK.txt
TempGBOXK.txt
TempGHENF.txt
TempGKFNB.txt
TempGRXOM.txt
TempGSDCG.txt
TempGUCPO.txt
TempGUCQP.txt
TempGUCQP.txt
TempGXGGP.txt
TempGYWFF.txt
TempHIRMV.txt
TempHPBIM.txt
TempHUBYY.txt
TempIACQM.txt
TempIKTPC.txt
TempIOTFD.txt
TempIRDYC.txt
TempIREDR.txt
TempIRNVM.txt
TempIUFEI.txt
TempJABDR.txt
TempJHLGO.txt
TempJLUQD.txt
TempJPUFD.txt
TempJQKPA.txt
TempJQLPA.txt
TempJRDKO.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSNWN.txt
TempJSOWN.txt
TempJSOWN.txt
TempJXFNF.txt
TempKCGUL.txt
TempKHQCI.txt
TempKIMHP.txt
TempKIMHP.txt
TempKLIQC.txt
TempKLUQE.txt
TempKTFLQ.txt
TempKTFLQ.txt
TempKVSQU.txt
TempKWHGK.txt
TempKWIGK.txt
TempKXBBY.txt
TempKXFTS.txt
TempKXFTS.txt
TempKYGOF.txt
TempKYGUT.txt
TempLHVUG.txt
TempLHVUG.txt
TempLIRDJ.txt
TempLNWSF.txt
TempLYGPG.txt
TempLYGUT.txt
TempMADDC.txt
TempMBKWT.txt
TempMEYBN.txt
TempMHQHF.txt
TempMHQHF.txt
TempMJRDK.txt
TempMNWSA.txt
TempMNWSF.txt
TempMPRWC.txt
TempMPRWC.txt
TempMPRWC.txt
TempMUGNR.txt
TempMUGNR.txt
TempMVHNS.txt
TempMVREB.txt
TempMVREB.txt
TempMVREC.txt
TempMYUAS.txt
TempMYVUY.txt
TempNGJKT.bat
TempNJXWI.txt
TempNOXTA.txt
TempNQRWD.txt
TempNVJJK.txt
TempOAHLC.txt
TempOBHMC.txt
TempOJXWI.txt
TempOMQLS.txt
TempOMREH.txt
TempOPYAT.txt
TempOPYUB.txt
TempOVKKL.txt
TempOXTAG.txt
TempPCINA.txt
TempPESAI.txt
TempPKDGH.txt
TempPKDHI.txt
TempPPYAU.txt
TempPPYAU.txt
TempPQNWI.txt
TempPTOWK.txt
TempPTOWK.txt
TempPUGDH.txt
TempPVLJN.txt
TempPXODM.txt
TempPXPEM.txt
TempPYAUT.txt
TempPYPEN.txt
TempQBUUJ.txt
TempQBVUJ.txt
TempQCVVJ.txt
TempQMLTK.txt
TempQNWIO.txt
TempQSXDE.txt
TempQUGEI.txt
TempQUPXL.txt
TempQUPXM.txt
TempQWMKO.txt
TempRMTII.txt
TempRMUIJ.txt
TempRPSHV.txt
TempRQFOB.txt
TempRRCWV.txt
TempRSXEF.txt
TempRSXEF.txt
TempRSYEF.txt
TempSDWWL.txt
TempSQUPX.txt
TempSRATJ.txt
TempSTYEF.txt
TempTBPOA.txt
TempTBPOA.txt
TempTCNUK.txt
TempTFLQC.txt
TempTOXOD.txt
TempTPNRM.txt
TempTRVQY.txt
TempTUGHE.txt
TempTYKIM.txt
TempUCPOB.txt
TempUEPVM.txt
TempUGMRD.txt
TempUGMRD.txt
TempUQYPE.txt
TempURVQY.txt
TempVASWS.txt
TempVHFJE.txt
TempVHFJE.txt
TempVHFJX.txt
TempVHNSE.bat
TempVIOTE.txt
TempVJKKT.txt
TempVLXIH.txt
TempVUHPG.txt
TempVVPIN.txt
TempVXCSL.txt
TempWALYJ.txt
TempWCUYT.txt
TempWHFJE.txt
TempWHFKX.txt
TempWIGKF.txt
TempWIOTF.txt
TempWRRGP.txt
TempWRRGP.txt
TempWTCNU.txt
TempXAMYK.txt
TempXCUYT.txt
TempXDVUQ.txt
TempXFNEC.txt
TempXGGPK.txt
TempXGHPL.txt
TempXSSHQ.txt
TempXTAGD.txt
TempXWTTU.txt
TempXXMVI.txt
TempYAUTI.txt
TempYFGDL.txt
TempYJKHQ.txt
TempYKIMH.txt
TempYPNRM.txt
TempYWFGO.txt
service.txt
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
service.exe
memory/448-4894-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1108-4325-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1444-4830-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1724-1372-0x0000000000400000-0x0000000000471000-memory.dmp
memory/1848-754-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2228-2266-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-4311-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-660-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-5104-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-3624-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-2423-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-3224-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-659-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-4886-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-2740-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-1141-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-4666-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-4140-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2276-1998-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2572-4665-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2776-3229-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2836-3287-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3208-4710-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3492-4778-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3736-5061-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4040-1167-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4048-1794-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4056-2027-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4104-3300-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4476-1067-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4556-1501-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4724-4358-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4744-4387-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4872-5006-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4976-3871-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5128-4078-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5136-4753-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5164-4769-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5216-3956-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5252-4330-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5296-3286-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5368-3675-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5536-4045-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5564-4712-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5564-4077-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5768-4207-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5840-4064-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5852-4686-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5968-3356-0x0000000000400000-0x0000000000471000-memory.dmp
memory/6012-3491-0x0000000000400000-0x0000000000471000-memory.dmp