Analysis
-
max time kernel
35s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01/10/2022, 17:27
General
-
Target
96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe
-
Size
564KB
-
MD5
67aebb5b12ae70764e7835e5305bc460
-
SHA1
570d85a6ab69874f18458ee3de795c43321c4273
-
SHA256
96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e
-
SHA512
9846f822d6c0884c538544901f4d99623401690f769e8d504c1fc6a0f684fb7757e0db575720b6ac96487820c683a15b34d0b6c41346e270df5c739865696cdb
-
SSDEEP
12288:SeIHWQg2OJo6UTopWHLo/4NmOB2ltVb70tekUyoWaVscRKQv+8Y67:Seug2wmopW8/4Nmjl70Z9ajpl37
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 62 IoCs
-
UAC bypass 3 TTPs 60 IoCs
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 24 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe"C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\iQcIYgww\oUwQoEwM.exe"C:\Users\Admin\iQcIYgww\oUwQoEwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\JaAsQUUI\TyUoYoQs.exe"C:\ProgramData\JaAsQUUI\TyUoYoQs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"8⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"10⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yykQAgYY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YKosIQsw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"8⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naYsUgYQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VAMEgcUY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkMIIMYA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"3⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e4⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"5⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"7⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e8⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"9⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkQkIIkg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""13⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xMYooMYQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""11⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs12⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f11⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 211⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 111⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pywYwIEI.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""9⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs10⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f9⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 29⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 19⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mYYIgEIo.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""7⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fQEcoMUw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGckkEYM.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""3⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMUEcsEg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\RmQgcwww\GkIwIIIs.exeC:\ProgramData\RmQgcwww\GkIwIIIs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"4⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"6⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"8⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"10⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"12⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"14⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"16⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"18⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"20⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"22⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"24⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"26⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"28⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"30⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e31⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VOwgIsAE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"32⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"34⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"36⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NIcUEEQc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"38⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yqIkEUMk.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""36⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAoYsEgw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""34⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EqckcAAc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIwgMAYE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CewQsIQs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tKQIoMEs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYMkUcQk.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EoMEwwMw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"20⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e21⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tycIEcAg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""20⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
- UAC bypass
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LAcoIQUU.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cuAcQUwI.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGQYgYMk.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qUEUoAkY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XgwoEsMw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VqIwcAAM.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"8⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HskcYAok.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ngQEQYIw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jaogEswA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"8⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWEQIogg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"6⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VyMAoQsQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMAsIocA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eysMMkYA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BiYUQIEs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uQsoAkYM.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dsgMoIIc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dAAYAoQI.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgwAQgwY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cGMwAYAY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"2⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQEcccwA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- UAC bypass
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWkccIoY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIUQscIE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"3⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MckkIYEE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ocMskIso.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"3⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"5⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"11⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"15⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e16⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"17⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e18⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"19⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e20⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"21⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV122⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"23⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"25⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e26⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"27⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e28⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"29⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV130⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"32⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"34⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"36⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e37⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmMwAQEA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BUYQAooc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"31⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"33⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"37⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"39⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"41⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"43⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"45⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV146⤵
- UAC bypass
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"47⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"49⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"51⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV152⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"53⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"55⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"57⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"61⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"63⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"65⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"67⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e68⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"69⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e70⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"71⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mqgYQYUI.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""71⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs72⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f71⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 271⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 171⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JIcIgcAs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""69⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs70⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f69⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 269⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 169⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mWMskUkU.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""67⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs68⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f67⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 267⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 167⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tMckcQIY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""65⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs66⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f65⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 265⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 165⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYUQMwAA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""63⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs64⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f63⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 263⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 163⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qaoIkAUc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""61⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs62⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f61⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 261⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 161⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CSUMYIgU.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs60⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f59⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 259⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 159⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HEEYAsYY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""57⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV158⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs58⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f57⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 257⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 157⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIMoUUYg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""55⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs56⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f55⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 255⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 155⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nuYkIgco.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""53⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs54⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f53⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 253⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 153⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vaokkEYA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""51⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs52⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f51⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 251⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 151⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 149⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SaQgIYQg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""49⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs50⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f49⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 249⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 147⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 247⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oqggEwIc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""47⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs48⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f47⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xGIEwAIA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""45⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs46⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f45⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 245⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 145⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f43⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WGwEwgwk.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""43⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs44⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 243⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 143⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 141⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 241⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f41⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nqksoEYw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""41⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs42⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 139⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 239⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f39⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NoUAQMYg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""39⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs40⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGIAcsAQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""37⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV138⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs38⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f37⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 237⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 137⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 235⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UQUQkksc.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""35⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs36⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f35⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 135⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 133⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 233⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COAcAYYs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""33⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs34⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f33⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 231⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 131⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IQcwcQQw.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""31⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs32⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f31⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWogIIUo.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""29⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs30⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f29⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 229⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 129⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 127⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 227⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkskswEY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""27⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs28⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f27⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GsUAIgIs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""25⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs26⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f25⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 225⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 125⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 123⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 223⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\teMwYMYE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""23⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs24⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f23⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 121⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV122⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deIwQMYA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""21⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs22⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f21⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 221⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 119⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\weQgEgMQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""19⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs20⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f19⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 219⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 117⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\suQUUsIA.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""17⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs18⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f17⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 217⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 115⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IwMkwEEY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""15⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs16⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 215⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 113⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awIIEggs.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""13⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs14⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f13⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 213⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 111⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f11⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XsgoIQgE.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs12⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 211⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 19⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RQAUMswM.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""9⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 29⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmIcUMwY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""7⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs8⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmUEUkgY.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rUwUMgwQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""3⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ymkkscwk.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HAUUYIEg.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIQkYUgI.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMMwAsQQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUIYMQYU.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exeC:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lUcAsEEQ.bat" "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\96f37a5838762ee598ec925d80b741116ba37c8f1605859f5164bbb8cc42125e"1⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD583dc529aefb44f38ad83260d66f41cd5
SHA1dea77cc56ee2ab19cd861dfc150daf210a140d55
SHA2563f96163bf29ae2c5bad01161911f3efae90a7a759311c865b5ba8c2fb04f909a
SHA5123e134ef9494426e6b91376929dd08c4446426e6fe9d03028c00cecdbf2555daa1ec2a39b8c65b2063d4d15e7f365d504496810efc8779c4784bb3a21e6b97c9b
-
Filesize
484KB
MD583dc529aefb44f38ad83260d66f41cd5
SHA1dea77cc56ee2ab19cd861dfc150daf210a140d55
SHA2563f96163bf29ae2c5bad01161911f3efae90a7a759311c865b5ba8c2fb04f909a
SHA5123e134ef9494426e6b91376929dd08c4446426e6fe9d03028c00cecdbf2555daa1ec2a39b8c65b2063d4d15e7f365d504496810efc8779c4784bb3a21e6b97c9b
-
Filesize
483KB
MD53bc2ae5a5111bbf41ebd8163e80fb8a0
SHA1314e8bd6b0c734b098c2c2bdf23d501175666b2a
SHA256b731643db005872f9e30a4a78d9ab73818afca5d6b8b4263a427dfdb68e1f25e
SHA51216659936fe4a2caa1cc366c2aa33cad023be4b331e8269c24a75eb671f34493bf86800afc1267528d3447d5b77b3bc79faf1138ff3048f139e5b0e817d379fcf
-
Filesize
483KB
MD53bc2ae5a5111bbf41ebd8163e80fb8a0
SHA1314e8bd6b0c734b098c2c2bdf23d501175666b2a
SHA256b731643db005872f9e30a4a78d9ab73818afca5d6b8b4263a427dfdb68e1f25e
SHA51216659936fe4a2caa1cc366c2aa33cad023be4b331e8269c24a75eb671f34493bf86800afc1267528d3447d5b77b3bc79faf1138ff3048f139e5b0e817d379fcf
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
75KB
MD53df360b9de481c9f41b562c14765b03d
SHA100a7c134ef5e34efabff9a14506ca372e5459b4a
SHA256c491fc25d5ccc0a745bd55720fbcf72b6c67e8a26862ad8934dab998098ad39e
SHA512f0e03911a8f636f0c94bdfde7a9bc53b012d2d906825da0396ea3224948aa1a3f4ce87785e9fced4eae02961c6d03acb5681d226713cc853ff6f1cce5e382fc5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
482KB
MD5bfbc8ad044f231d5ba228f98b3112217
SHA1dcf5f7db7487c7cf11f0100d356d40ddb5925dee
SHA256d11c51ac86e0aa9d7e964ed2edd96dcb86d0db705dee95de5238d8af3f6be8ba
SHA5123a32a0ce6c0622e7a5d263cd7aa0c661abe567501b0e0060c56618531917ac8d5b746997657d926c56060b09e02d0d4233ee0375824d997abf6c46dd66a3b425
-
Filesize
482KB
MD5bfbc8ad044f231d5ba228f98b3112217
SHA1dcf5f7db7487c7cf11f0100d356d40ddb5925dee
SHA256d11c51ac86e0aa9d7e964ed2edd96dcb86d0db705dee95de5238d8af3f6be8ba
SHA5123a32a0ce6c0622e7a5d263cd7aa0c661abe567501b0e0060c56618531917ac8d5b746997657d926c56060b09e02d0d4233ee0375824d997abf6c46dd66a3b425
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB