Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 11:16
General
-
Target
1a1e0dadede90fff9bc3e115c3e71da6.exe
-
Size
484KB
-
MD5
1a1e0dadede90fff9bc3e115c3e71da6
-
SHA1
58c93beec97df100f565ab9533353cd456a72380
-
SHA256
b5bc9eba7dea50a283115771c3e3c0c7a25333ce729537fc96fc8782e4767128
-
SHA512
88058ea2048be2f80128654c743e57b01fa02bd1987b50324b0c44cca345789b7509bc063faadabb6c1a024a4ae29a49c63b8a1a61bea4f79de39c308199201f
-
SSDEEP
6144:Y03U3tjQGgI/NaqEuaIhI/Igpzuf8B6O13ALfTeotio/wwp7LBHpY9yTirt3O1hs:Y03ZGrIq9V6IaG1Q3GfhtFZl6XUS4EN
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 6 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe"C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\GsMwcoIw\qKgooUgY.exe"C:\Users\Admin\GsMwcoIw\qKgooUgY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\ZiscsYYA\buYwkcQA.exe"C:\ProgramData\ZiscsYYA\buYwkcQA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da63⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da65⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da67⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"8⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da69⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"10⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da611⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"12⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da613⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"14⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da615⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"16⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da617⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"18⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da619⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"20⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da621⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"22⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da623⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"24⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da625⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"26⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da627⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"28⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da629⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"30⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da631⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"32⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da633⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"34⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da635⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"36⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da637⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"38⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da639⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"40⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da641⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"42⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da643⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"44⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da645⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"46⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da647⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"48⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da649⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"50⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da651⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"52⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da653⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"54⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da655⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"56⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da657⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"58⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da659⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"60⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da661⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"62⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da663⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"64⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GwAkUkos.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUIQEAUM.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TooEkQYA.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgEosIwQ.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hokswwcU.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEksYwEM.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akUcEEow.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWIgkgQo.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uakMQAEs.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LWoAUgUo.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSYUMsIc.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsYwogIU.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqQsIAII.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCMwYIQQ.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DMcQckQw.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mAUYIsks.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqcAQMUY.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aegooQkE.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HWUAwIwo.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYcoMcEk.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nuMcIsAI.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pOggAgsA.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmMAUsoE.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msQQMcgY.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkogUoQY.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ICgkEAgU.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jygMAcMU.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WuYgEIkk.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KEQUcckI.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMYAQwks.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PeYEcwAA.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XyAQYwgE.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\VikEAQko\SYwUAkUg.exeC:\ProgramData\VikEAQko\SYwUAkUg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwgEscAg.bat" "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"8⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"10⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da611⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"12⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da613⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"14⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da615⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"16⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da617⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"18⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da619⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"20⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da621⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"22⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da623⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"24⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da625⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"26⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da627⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"28⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da629⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"30⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da631⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"32⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da633⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"34⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da635⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"36⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da637⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"38⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da639⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"40⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da641⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"42⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da643⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"44⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da645⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"46⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da647⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"48⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da649⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"50⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da651⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"52⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da653⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"54⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da655⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"56⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da657⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"58⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da659⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"60⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da661⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"62⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da663⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"64⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da665⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"66⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da667⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da669⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"70⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da671⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"72⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da673⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"74⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da675⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"76⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da677⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"78⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da679⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"80⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da681⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"82⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da683⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"84⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da685⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"86⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da687⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"88⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da689⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da691⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"92⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da693⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da695⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"96⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da697⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"98⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da699⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"104⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"106⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"108⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"110⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"114⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"116⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"118⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6"120⤵
-
C:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6.exeC:\Users\Admin\AppData\Local\Temp\1a1e0dadede90fff9bc3e115c3e71da6121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-