Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 05:53
General
-
Target
581799237e8f5c3cecfedfb6b8aaeb7a.exe
-
Size
484KB
-
MD5
581799237e8f5c3cecfedfb6b8aaeb7a
-
SHA1
2964ab933b7bf2c7a04ce2fcbc4b7820431c699a
-
SHA256
559741c9738226c2573fa4188a1a465563926b28d885f80e6507fee91bde626e
-
SHA512
aeb02472d44741ae40bd0bbb0b54525c76ec54a9d49813684adf1dde60b80d5c9c0214230d5f722761ca1ad0425ba967190fa5c23b520a189a63f617bd40928f
-
SSDEEP
6144:byEjM5jcA3YDMThyH4JXkUGzekBdxacADVsS3dT/Y5sYl2i69h88HoihJEmYQUmv:byEjMvIIBtYLdsDVVJqkJbrvh/+g
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 14 IoCs
-
Drops file in System32 directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe"C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\JOkcUAUs\jcMkIYEI.exe"C:\Users\Admin\JOkcUAUs\jcMkIYEI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\UikAIEUs\dKYEcsIc.exe"C:\ProgramData\UikAIEUs\dKYEcsIc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"10⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"12⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"14⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"16⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"18⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"20⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"22⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"24⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"26⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"28⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"30⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMcccEYI.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dSQAEMYI.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZMAoAksw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"27⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"29⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dUsUgoUw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nmAsYAQk.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EuIAkIws.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV122⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xucYMIUA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yKkQgssk.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMYYUIIw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\woYwkMgs.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGAEsMQw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LyEIEYEo.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"10⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AAYUoook.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""10⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f11⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 211⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 111⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GKkMQoAw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZiEEMYkA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WUksoIUM.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAwIwckU.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\BmQUUkMc\JEwAYsYI.exeC:\ProgramData\BmQUUkMc\JEwAYsYI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DcAgoEkc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XOUIwYgo.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuEUUsMc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mosYIAgo.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\USwcMEMg.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VioIYYUQ.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsEQAsUs.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bUgcwAMY.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUUswUcE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VaYYsYcU.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gKcUgEEw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""7⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egEckQYk.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies registry key
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CooIEcYE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dEMsEEYQ.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQksYwoA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQAEIYIE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XYQUIocc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZaQYccgE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iSgMQQcQ.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vgccIUMY.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsEMkYQA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqoUYAEE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eKEUAkgw.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"1⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOwYsgYo.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- UAC bypass
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EucEUowA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"2⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"4⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a5⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"6⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"8⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"10⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"12⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
- UAC bypass
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"14⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"16⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"18⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"20⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"22⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"26⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"36⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"42⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"50⤵
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a51⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a"52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
- UAC bypass
-
-
C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exeC:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EeIMAQMM.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JEscUAsk.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TwEQwEoc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""48⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fIAQAkkc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
- UAC bypass
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QokkkMgM.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tAQAosog.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""42⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SCoosEIY.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YEQIkwow.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""38⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQoUsoYE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RyoUYwcE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eIQQokEA.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""32⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\liwQkUcY.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
- UAC bypass
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucEEYAIc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ecccEQUk.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uWQMAgok.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\poksAkgE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KuIIkUwc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wWQEYoks.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FUIEwwkc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIogUcIc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""14⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tuwIQcUg.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qYUYkwEc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NYUoYQQs.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCEQoUIE.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKIYAoQQ.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nIQoEEQc.bat" "C:\Users\Admin\AppData\Local\Temp\581799237e8f5c3cecfedfb6b8aaeb7a.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD591c003ca2f8e0b04422d424fa93c1332
SHA1a61a680131a8947e05cb80e6eccc978198e2bd60
SHA256db45a51c6961c381833cb5ef60d20ccb47979493088196c080a1662de115f89b
SHA5120e1118b119dc25dd9f135d0b6f1513837187925696bec3040fa8cfba8ccacf2da74d6eef3bd033f95285b33486c77e12c19be1737f029165ae8c62cb247b3581
-
Filesize
431KB
MD5e586146534d460e00a12d7c8879fe062
SHA1b25b9b94e805066855af36531297814606b15af9
SHA25685c2766fc17458fc9325d257371a24d7dd8cb0eb60ae256727e4a39894912b83
SHA5121040fe93ead6ce77266d958df38933209fea12159c2cf30c0f7bf43546e62267b0b9c381949716a388ed6a3663ff23f43529575049378ae5926d623c75ab61dd
-
Filesize
2KB
MD54798f4698666ced3ada149bc6bcdc98b
SHA115b8dfa2a55157fec6335b605809bbbce7200a8f
SHA2561c2ea529610ab294f0967d632e594656f4ddde8071ed892d1e12fdf09dfe3f49
SHA5127407bab97590515d9759cceda15932d280efbf7091a2d3e07b63e243f659e9370dba6f3850021b7d4427b6db768447e97c9048939b4729e91c71b055c591a32b
-
Filesize
48KB
MD5962093c737839e34489f80e492c4ebfe
SHA1097a7e3bbdc5bd954666f87f7e505104c652e227
SHA256665784bf5a2b6813e22449ec557faed6f2bba3925fd07ff6a27629f06bf5f9a1
SHA51282cb897dda8316917f25129f13e88b8c248829ecc7d54f90109e18a76a44698ea19d3385de359f8ec3e2690f3c46340da807e77417f309009c338e3d38cedf1b
-
Filesize
440KB
MD580c6ec6a0498253a8c50325fa8bed161
SHA141cc94f118d9d6df8e4aec5b9dd06bf36983caa8
SHA256eecb5f51a78c9d2317e72ca4ba1531d6682cbce6f853294b459fbeefe6d6f680
SHA512ec6a6b272a91a4574376751ed08ae0cb5b2781cf976c3d1990146f2ee8a2dddd1fd5c9a62a7f71afebf154afc7042948cbdc51b06104f0c62a39666f81dcc507
-
Filesize
1.1MB
MD54e25ac1d5715ea4e274a5dea43880538
SHA1c00dccb4e9acbbb3267e266ccb2f1c05971ecf30
SHA256612c04fecf9788c8e59321faa1dd6ae36235bf5604317e900bc7b65db352fc93
SHA51297abf13774ad808ccc3aeb1679ca651b7076e0503466184aa92b02c3cedc1fbbe68a6909183f4e830c4220f4ab077148379e0a40e48e8323c9712322b6792bf7
-
Filesize
3KB
MD58ede39881ca4c11d1723540f61085b7e
SHA1f4c65a345b7fc686e46f3f275e29e533623f4c2c
SHA25616bec58ea7f130c63a408a2dde259d6f4dd3b0345b84010984c9e0bbe6bdbf3b
SHA512ee0d45c84a8151af6dc97b1f8785ba467b062ff301db8e594826ddfd77347ff736a1401b1745c61edb7cf78efa9ab9d6c7fd4e9e607801cd17061009bdf18bc8
-
Filesize
670KB
MD57a7ae0848ec28f303b05d213ada9b5b9
SHA1214dcc082a3eda2f0be04247702044665f7a7068
SHA256742f786f96965bc420d5302391cf9e833afebee8049e5a65eff0bf43deba297e
SHA512de02ffd96157c1ba995955807125988db430fd2b8496481b73c5b0f99ce9a226c762873e9a7a5aef865482ac8f574fba934bfff1a2e33c525477559e46c5e0d5
-
Filesize
177KB
MD5d2b257ff65f530600456cf3d8e80eedd
SHA13447d6df9cd76401cc0e24e6862c7f3d12a10b68
SHA25640016aa205df37469aabbedede6dee1be864bf27b11f148d293047ca7e712b78
SHA512777e51d25c60362617622bc32e7bea984d9e267c1a6a9eae4fea0324ef3b621a59f9bec0fe1f24f37dc7224ed96eaea2bbf9acdf83b93c9ab3bd0f58ef7fa3e1
-
Filesize
438KB
MD57f7213ed4df9db729c23b3020ba083fe
SHA1cc27742e87b3ef0ede98adbcf22952c8731a8aaa
SHA256efcf10ff9a9acf8c34f42cf6e6362417eaa3ab1bb51e9b49be3146532b878d0d
SHA5126a4a146740f2f128369d88136e13f92400b9caf209408b691e10dd7dca49b1f8f0609117509c44db23352652f141efe34485638566533ce4f77d198e233c45df
-
Filesize
92KB
MD54e7df42a9e09024de56b187399c1cce3
SHA13e8628ca82c88dffa19d6edbd60a192a1da95f3f
SHA256ed520aed92880766e024d252524769dcf1afaac46f80d611d3e2169e27ef0c29
SHA51221ba7f1723f0902a4bffad8bd10b7a4f8a192a485acb110ac2956a01f89648157da3298de0f167fcbd9fb710671cb78b93014aa0371d44bf8d4c8aad0727041e
-
Filesize
5.5MB
MD57f573c9c80d624c54531a504139191fd
SHA1242d9fe17ffb1d403fe9675da4fbdcb8fd78968b
SHA256fd5c6dbf6146dd57efd6589db35d1cc8bc4069eb931d5a5237a2041ea086d779
SHA51218a9828233b4c43fc7356e1d95d3d7e61a515c2da6d8c0e2d1ba0975967a002491ba24aed6f64401eb92397eda4c2bc7c20d56033b80b5f09d784a304ff891a0
-
Filesize
438KB
MD59690da822ca345c1682da32635640e34
SHA1d513c8b5d6e4cd5a2bf8dead399b63a743660fc0
SHA256ed27808e7c60ae82fc9cf8f4a47ba9f82d82ed54a5b01069e0e3c0e50513b008
SHA51215637d2ba7576ee1f50dce95f0cf9010ac9cbb6fdba6df361221dc2b6dda800ed225f5431e26612571d91b5afbd062971232c8f96ba5c718d779a8f788a57718
-
Filesize
140KB
MD58e0c650738f9a68b9f7b9f6be4ce8003
SHA1564511f3e009c6c839c000d4a76b306fda40185a
SHA256072c6e905efee8a1f915def4c0204c876e61e303f8ad74b8a2c0b7fc9e89c461
SHA5120dcdb5513c4f5ebab7eb038f8c8282e4de9c3e075e212f477e2aa30cf8033d1db63be2687fed2d599032c8e8e2292b80a35b88d4c1abe58a5e43bd97464a0aaa
-
Filesize
78KB
MD5cc91500f27e06f532d482b7f07e903ab
SHA11db04b5f65c30ed958cdd62571ab3ac3c3f48972
SHA2562d4b07ad7d65cf809ccf5102b1b4e3880666db0ba549d98b73d459a98770523a
SHA512398edfa674aca6a44c0d1238166613fa3602a786db4a1278f80e4a0189c6eca1d7f5bc1789b97ee338d766eae95050f97dc6731314fe29bae3e87e84fd69d9b6
-
Filesize
438KB
MD5a689248196042cf39da90a9c9cccc33b
SHA1c02d4208afae515abf69785b48383590f560dfe3
SHA25675b667d2a16936432b3be5c9d81f8c66aaddcae17597b61a82c2f3fe8ca801d5
SHA51291cb16a4201ff6be2cbdc38f92abc037fb05d989f53c7055f800ccef74349185de1bbe9aaf76786f365f44f256ac8c6fc982d16b2f6cefda5ef7758a08a258ce
-
Filesize
436KB
MD54dfd575ca2c9ff25d103167777c8b1f2
SHA1c7c41220b6b66257c521153beb27f1b97a388d36
SHA256336f40a4b36e74a9078f1f00fd7cbf191f4e80daf80e4a469b9be377d7aec2d2
SHA512d5bb93f470e9f0093eb3e37ae8ca59d34a8a4ac7f64193edbad8cfd5e5c329ff8d2beddbb4ab434c282c1ea3c8948d04158a4993389f8b8bfa24e6c32ef27147
-
Filesize
1018KB
MD50a98a9f66bd5e3cc41630c4ae1ea7b63
SHA1775cdf281ffacef5e3894372317003c1fd90b40e
SHA256736c50c508594c5bd09f307be185ad831ef352a513316492c2917e430ebf571b
SHA5123a565efbac7b36e78549a8ed6d1fef06e5489fe02a36bd6691a2e8638e05dd401b8cb12ff25c90e6c4f84b5f7d9e804250b567bb82c2cd4736dbcd18dab48f37
-
Filesize
439KB
MD58b518a5fe14e6b95c3b14c462ab0b801
SHA19ae69c09727122fd507131df39dc002a79944e69
SHA256ab268ac9cc9eba47d0f025aa0e7aceda727245a5a010bd803811cff063899de5
SHA512c3e11a8a0493a45cb9f2f1de356e960d71b861102321eabc5be91bd0ff0cd48dfff85aad34d735496c1135db165cec665f8afc7667f10d347a011a674f6d692f
-
Filesize
397KB
MD53cf1bb79b5456d86ab2ee18ebdc55271
SHA11e1c81873e038f8d9086597ec32b3bbf64ae4da4
SHA2564cb25e6207a8ecc7fc004dc686da26c8fda97bc1ebee3ea34e1118a781d0bd1b
SHA5129ee002f39490b9df483864d246007d427fd754e408ef1f3434b01ab7f757c05115e04bc198b78d0203aae66e8c46eb24cf0c917e43fe6f67c8a67cdf1fbfca4c
-
Filesize
281KB
MD545f38ae7885b76976eecaac2ae245762
SHA19a2c9b99c753132589843be6dd58280ea7edceb2
SHA256a8497ec3cd2e7db0804b5957a24b38a0fa45cbe8d389d443ba377ef1b7b558f8
SHA5123d9cb2b25d525e88863532d10e7e66bc73d77a8f2eb2280bb9c5653088e10313eda7a51a5ec47abc3be1c89e8bec12ed7b91784ed2bedb68eb7708b5b5369dd7
-
Filesize
471KB
MD576d76ffc93de9c3e68d389963eac130f
SHA11b95631db2a55150ae239571772e1cdb94c5fdfe
SHA25679b6f53e34f92320833e041df6af5a7812f836698dd215ed71231c70eeafad8f
SHA512b253994743b29c73a3b5c49f775ae397ebb5c1f546c0a5e12a73454875665124f32cf1cb30993c7be33eb69b98c2953aed63d305ed691ca3f9a8d3859c4d6628
-
Filesize
876KB
MD5983dc37e3038635552e047b87e03c127
SHA18dddb8e38b7b69fb330ab68d390e9977f70dbf61
SHA256adc9137745e4b41694c1e8f2e599a895e122bd85e871204c7f89985a1e4fac69
SHA5127081dae0acd93ab5be6ae10b9b603a7f3a1286f1326cb607565993b2297640259f68fd84f5cabbe18a582eef4bacfd915f2408067613d4340e020ba05dd3af58
-
Filesize
434KB
MD56b9bf4e3c3fbe74f531e941e6566caf4
SHA19e4152280f409d20fc520b256da35cf74e7d9dfa
SHA256c16c9d3b0fc4d898aaa3318297a76ee4b6a7bd6fde6fd1d30a0e123a2e18e88d
SHA512852b6bc5442cc37b84674e52de1b1c6cebc6cc0c3af30c014984aa04628960408b0f0d4288cd105be1fcf50007beabfaab751bb0c4c132271df77ecd64782613
-
Filesize
71KB
MD5bda10572bcc851da3b3cb27e8690e460
SHA1a97d8c51e9c45fe7763ce0774d9b8916228d5cd6
SHA25690037c5af75baed536e08aaec684ac547695bcebd6c3c2e67c4a0b3b2973ab7b
SHA512114bb48e6364256b7848ba781291387a4ba4ba43a880574ec0c79029870f5f429ab5cc487007b4d33055dbb19000ce60e29e818f3dfb194e244615ea4593e07d
-
Filesize
559KB
MD5e6dce4a9bd490e6e132470093653241e
SHA1937009ac855d2d9b9b5170403f346d115c153e35
SHA25620594929824a3edc9e129673afc8c543a7a7eb95f5e9da9d072767fc4c1f7188
SHA512043b48b5c8e4add5aeda99a82a855ab8f0e372622c0d5cb9f435ace9ad7fcc43d0f92aafcb99414b624380dbd71b511eb6eeace1edcb7387565931de3fba60ba
-
Filesize
888KB
MD5815fa958219eb3da93b20098bdbb24cd
SHA193b662bd9190602d9637c7741b372b2313453a37
SHA2566be5a26096d8877a0bfa917daf5ebff2b8ca86192ead2b68370bd4b78413018b
SHA512ab346bbc7fe57dfd0487ec50e82bd6d9a6696c69f82b4d965b19466f29d92c7577075dacdc66a867ee603723fc7554c5ab0350512cb14a8c39680587c2a1bed2
-
Filesize
436KB
MD544816ecf9bb1b6cb0911e0716ed6ecaa
SHA1ee6b5d268c175200b27393987a9456810d70db7c
SHA256b5307b6a844dd5d3d2a2822cb7808f3fee7ad3836b0e2a083e8d4694dda7decb
SHA512ea04d9e2804bc0ac56fb33a8817e8a9eed0c940a49a38f76cab1257abbd0f1e3b1195445ccac2b3515554b6bb475adf133208bcf072def8338dd9fb93f67e252
-
Filesize
416KB
MD5ba885a20437551f43aa9ff98d69245a1
SHA1809a27f595acef6235d14fc0b5e899c1e721868b
SHA25628f181211e742bf8a67263ac624e701d3aa8eebd8644f2eac3e414b96af2ab42
SHA512253d575d8848206759dc3fcbad333ca12df6ae264b975eafd7526dddd6e85c67084b746b1ddb4be62434621c3423768bc8fbcb75e851525098904912ea52edb4
-
Filesize
441KB
MD5ad3d219a472dd770c3b69e1ba700809d
SHA11153fa7cc59e232762f23efa94a591326fb3c6a7
SHA256e9415395916733f3966a6fb2b3946622cfabab0ae2b37c95db09c46a9c02a65f
SHA51284c4e2351c11018c71605dc9c53d0b033335919897ed7befe4d995537c41fb1c7dc0f448600d1f453dc24692d619dc0b4a836311787d8db1545a9f406830dcdc
-
Filesize
441KB
MD54dc71d9330f22bb7de22dc1b587e2320
SHA12f4e2f108645e415333b962a29705ef6aa40fa51
SHA2569725ac4689dc3a4e43b3d502225e030004d24944196962893fcf0e3a17152c20
SHA51209106fee0bddb7586de759218126a1a7aaeedead67c2036f6d1639ce596b3a2cdb8fc2a9521029fee828fa79a845a65dd36c471fe9db0bebe244b5fe2520f0e4
-
Filesize
92KB
MD586dfe6ddfe156e3d571bd88c71cb40be
SHA1df919edce08791f09f96f6483a6538bc745f5651
SHA256d54fd73d76ac34a119f94d82d25cc5878de433d615297c7f40588f6ec63eac5e
SHA512cef9f79284739f7534856a8e4b5e97bb71e9ca78631885bd3e1c8611a7b9f56cfd5b83c1d530323b793a57ef02894093c80b9a83f364aa87667e89edc75c61d2
-
Filesize
156KB
MD513fbe1b62a25237ad7a3851c9f50fe98
SHA134d8aac27c47ccb9502bfcefdd8959cdcc8eedbd
SHA256f70b60e8a069c1cba8ec9eda6882727dbd719598dc626fbff9146c247cac80e2
SHA512abd3a27afa8a6a8866252c26eef9c1f8065d32ea57307b70d8af75f63f6c37c561a0dd3ff121978e349874d78d3e9057ccffa36112cb3809e39650b8d1db3692
-
Filesize
32KB
MD5d831083ab82b90211a9d31ed8aba857c
SHA19017ae0f82cf4a5f55b72fdf26d6b5155c6ebc82
SHA2567355bf7bf1524d7ed296cd57b50c4c07641ac6607a2e127181a0e9a1857fb923
SHA512d956c3e79b038c5c10ddce6b62ae427d730e8ff41c99a7066bc0ac94ac0dec830934ce1473c810bdf25b7766e7d8a168919dc7515958d44148be3c925071d53b
-
Filesize
257KB
MD552be84126c4e8607f29489fff3f0161d
SHA10058356f724eaf484cc6b7533c118e502b414e7d
SHA256fd42535aaeedacd8ef6c9b66c52e5048b61621d0b0e3803a0d3fc12f131bb2c0
SHA5129bcff9926e23abff8d72dcf923229362923c0e3126e5e3aff16e3ba42e46a439afb2e6665bc069fe530c6a3f11374347a80fd3b1342d1febb7c949d8952697fc
-
Filesize
6.1MB
MD5c06d641e8b58e43cff95f7a3cb8315e4
SHA1136b53ea3b72151c3b4141ed71ed1e6ad02e3a0d
SHA25654d24d027a8da1c50ebf5455f3b34fe78a27a139a16430963c12ffb1f17586cf
SHA51236fb08c3a64bbf9501ee8290187080c3b5ece56d1f113465e454c07a3af132628360174063ad8cd04076ace7e493b506bdd268939b86c67eb052df7d5094f7b4
-
Filesize
979KB
MD5b0c881e622ec6cf5f5870922c5d228fa
SHA1421cd72589f8481ba0c3e5b87d3244d0e5d96791
SHA256f4e8cebe5242adfbd2faa15f2389bc146af119c8db3ae6e89696e7b624a21193
SHA512a5521a4a1144a034a3c0679f0a5729ba2934c8433d5cf24f7f87c36d6b4125d766259bc746e950b7d79a14cd8df603b42b5057fd6cb440bb4f11f1f422aec0d0
-
Filesize
437KB
MD544ec02dc5b75e723d4f7a7921c49723f
SHA1744cec8f4244ff29cb3be3138656807d33b5cd21
SHA2560f5619ba15fb56e72cfae72d3e086d78102c8dc043b89d76a7fbabc4c4664bcc
SHA5120ffa387b0106267366954e64e90771e5da839ab14227e7439086026ab93dc5a46bda3ab088df50ea78e34840717669198fbbc569653ef535a700d88c75d7eed2
-
Filesize
351KB
MD5753b781624e6ce50975290e74d87a735
SHA18b59b56384d1313e2dfbc853f2d35564d192beb5
SHA256219586b32a1a66be2a6e353441594518bdd85dbf0413d98858f759fb4cf610b5
SHA5122b3916825f767dc9a4386764135a13a4b4657b2c27696fff17e74c4f1ec30bbf3c8698aa0506802ca08fef198f1633bb3e676330a2d556c396b71ccdbbc9c428
-
Filesize
1KB
MD572743e7257fbf4406406386272c363df
SHA14d6df808961c1e58e6095a2726494ab17b8d1ba7
SHA256ea20fa01b90789046cc5d47a37d18b998702845bc3595db1397eb3fb97e87f30
SHA5124011fdb23acaf71a24eaef145f6d3e34b66088ff673da6b899e1f71401485330942aa0587ef9fe5d8132b31b52bf2089ed8a3318573c79056ecf60720c456244
-
Filesize
436KB
MD514862eaca4e84392b107f5ac28770ad6
SHA1c1185bb9609e73acb9e731a39b92af333abe0bee
SHA256847da13944ae57f365f144ef56b5ec1a9d9aa5f02aa08a0638c58baa3c2d59f4
SHA5128c080e473b6adbb25cbf6a21d08ad724003265076a1f7655b2d505a30a85ea4e262f7391aac6a513637022640e16c3a8be33e5fa0929d56b399783f5c033ef7b
-
Filesize
350KB
MD5a2dfa267c37e63f75fbc90b1eda62ec1
SHA11eabee1f494d785db7c389a0a47b32e68e96f808
SHA25615491fda21da59a926a021f7ed2c0fd100f306d7c00c3328087e26f5017fb4b6
SHA51258a4b58affbf25092c0471be02db37db14a013cb6081669ddc343b634e11bb9693047d3b09f33e65d5d3c7bb70bd0aeb12cfbb7e707ad829ad06c790fd58bb8e
-
Filesize
1.3MB
MD5ee65059f9d147ca372c855f10f51e5f1
SHA1cb6e0ff5bcc5f00b6898ad3c3ed6ac8b26f43e6e
SHA256305d98d457be29e5cbb3ed2f9f5925ef3acd1b4ef42cac3263bd4ba1d7684f98
SHA512e3c616187bdf27487cfcf63cdb4004f40e6b4bb695b3cf46b972900f73b11acc0896e9eae9618f7e7044e2679a9d5ccb4c84692ee696f081d00c8e5baeed5c6d
-
Filesize
434KB
MD52875150488a826be87682ef80d4e755f
SHA1d37dc745beebae5e31728408075bae59a322d526
SHA256736d89b5e5a3692a4f2c134a108d3628d54988752aa26465b2957ee4e4006e06
SHA5122724be5f95db287950dd083c067c663be3683340a5e714b6c9c60ceda0d0eefc05b4e6c42793920ef174a36299061b370820658dc9dbdd1c68381c5fc67eaf97
-
Filesize
1.0MB
MD55e1c67357a9a291256fd676e0f5127b1
SHA1c66d08df8b65ca89b20b8ee44825b7680ed45b83
SHA2566aed109678d2ee1fb28ce743e115461c6b0ef7c33c078e963bdc2a65974808c6
SHA512ff9ba801c223c5ed3796e19443b8d950b6fd88e4c7420500dfbf4d70d586ad6c6f1e855076e1bd355d77295588b0b3fc4047829b1769606cbc9279d675eb1d8d
-
Filesize
1.1MB
MD597240826881f6f2d2f799f06eb1ff37d
SHA1a70461af1a092bc550a59bf759abb30c5ebfde0c
SHA256215d758302a2cb0dc2108fa36193e52a97f7e2e72ba19d5c19f172461f4c80d1
SHA51275a6afc29d52b47e217a4b6c8bccae0fc63e0e20679e7f2d797e2373a8ab562eab5ead343b958835445f8778370eaff5aaa2ab643db3535852776c9760d3a50d
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
442KB
MD5ea1d0e22ba307d9c55cfd8ab433d9170
SHA16b39d1309b6edc337d250c7b46a07c0102b35d2e
SHA256c253ff8501cc328f143c815ec19a1abae4f6927d2b6af3354ad39364b1ad581c
SHA51256146e35a62c14ebabc9269277ec6ad4911c651d5c14deacef111e66d1c80463d4372d6662ac0b6dfb224c2a735a539898df64a9f2dbd8ecf70bcdbf05e53219
-
Filesize
4KB
MD5f31b7f660ecbc5e170657187cedd7942
SHA142f5efe966968c2b1f92fadd7c85863956014fb4
SHA256684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
SHA51262787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
-
Filesize
442KB
MD5bf63be0dc059cd66c35bf494209ca930
SHA100cc4396a47576176eebe8441d6b43212352cf58
SHA256e99f13b31dcdacdd955bbd305f12287a14701486f33f825ba49c416ee2726e3c
SHA512db9a4cb3693d77c939666c5180511661ae9d6fee1edf7ceafea15e5f2c9b806d48e6b3f8b8b71f122a3d8aabb24e83e457c6255473e3b875101ac3423db6d270
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
91KB
MD55ac64f854879152d927c8ce269c2413d
SHA167e9fb86875be7a76a5e47495aa77a11a4c2cb24
SHA2569562f9439f63c05c329eba7d6381c12350b9d21ef6d259eaa81d39fda63320fb
SHA512a7a4ff030fba7a244ea6e2d27ae1444e4f08ba767f925b761f208541a155aecf6c241e0b510fe0aebdbcda77343d395bf9c7a6325babec0f49ba163593368279
-
Filesize
434KB
MD5caa4877f3875ac348802264bc76e75d0
SHA197308a4c55077669e079d2b0f8c73eb52c4423c6
SHA256fed54021ac7e6572e9f8fc8bf4072fb42bb295f9e822582a085836076c23fa25
SHA5129ec259461d07b6e27b375bcbaaf5567a4c7f567eac9406c4d6d45c8d53a71b4a5ca9f72e4568bb5192c38e7a046d1bc2edf4e982c7e48f8469c1ecbf24458e88
-
Filesize
435KB
MD5914715fd9272a1b27cd5042eae836975
SHA105c586bab4936830055435477b8a6f4e6795bfeb
SHA2565f3e29cfcd40f0d7eaaf6d8b658842ed3baa6aabded2627b04ac3766600bd141
SHA5125398950c696d691578e31deaac3bf597d3e2a5da9c2ac62ac9a543abaed107d4dc517c7800aeed25d13980fefbed12ea95ac10dc8840c118efb95bd8be48c6ba
-
Filesize
64KB
MD57488fe586a4a448d08fb81ed71a0f095
SHA1275eb74f99094a7420c73d451b5befd39fb6f68a
SHA2566a069d74b36f3e4ecea6381d133fe4df2be2a72c6ad634f1985e34161e6db18e
SHA512152fdd4315945a5e6df6240c8c6416cf9f108701c0e3b2256c1b3d47bee66b09ee4728bc36e138a4e0055cc7733f14021e456cd1fd6d4f5e617e04a3c644e294
-
Filesize
443KB
MD5ca749d4f387399bf7b24aef5cf92ac5c
SHA1fe71e33a9581d52bc6e8ab5f0cda46c898b1e4df
SHA256c5c74da5952aea691888f468644ea025c7fe15b23368424685bcfb8926228733
SHA5129a446d3e8c32356c106a39ecd34ac10ae3aab831f111c00128fc144a5560f0b77819e40a9de58ec10888645b4ba7a505ef71dfcf003d18a9dc7c3955d070b389
-
Filesize
92KB
MD5de3c96a686ce036882aae8afe556830e
SHA1608c74fca8fb3e5a7e5d17d9b9ff6c2deeb2734d
SHA25649c56c40e3205ad1c3f8b4245326ec1bf8853efe25f1b18f7a883a70378e89ef
SHA512db5752b642a9f871f5b6694e2050d0e8a17e9fef2830df91ef9fcb8649dde3f2b7d5e6e20149f335669f647777cf62c5430f78275b004ad0c7b70ec91e851bfa
-
Filesize
436KB
MD5d0bdaa100271938f527c3c83c3809ed7
SHA11502628874065a911db393c52ca320a36cd53aa1
SHA2562497e322a113736b26ed11dbf8c9766988677aadf3e874887060916788bff79b
SHA5120a2bc43c817707ac28b266686d54ac357c5f9e61b9ec7ab5a4728f92cd0089ee42ece813e4609c99c8037291d7ea864a3412256b453fedb23461da746fea2719
-
Filesize
438KB
MD5086c8319e4eacc263032b478c8028687
SHA139e93b7507c64e7337a97749dcf9d99fbd737449
SHA256dce81f638ac5d5bc0d42e74b428944c376b4864fe12d171445a539bf48bee360
SHA5125915524410e848f7d56e647f5e966e86e6d902e4e9949ca2e08ce22410150d2d787397b54c9bed554985b9464c4a8b93ffd4e66f722eb1b3580b7b7f535323a5
-
Filesize
465KB
MD5b4847117b1b9782d350dc3b31e1f89a9
SHA13569983f3f60628e2b5a1681f72cf7bbef659a48
SHA2569cd9e7075139de083f7980f831812b3dc9a7a18dace4b58881ded85dbcd0e67e
SHA512653e1312b2be168847bbc23a7f27086ad2c00671b75dc08dfe6186d937b93b990a2dec22909dad9c037e310f185aeb50b2af97c0b999e71c47e8d353cd71dab3
-
Filesize
438KB
MD5665fa5c207e524bf3ce701a841c6bdd9
SHA1531682a41073db36190129f8ec35de23eeb07542
SHA256b6d886ffabbfe0e8dd0359f004482f7df4ae8fb2ce742d0f8ed7c898f4de3b93
SHA5128ebbdfd9400d68ef5fe2acbf2ce6f518224211fcc384545a7302cd1bdd4f04411da3fb6b6ef3ccc0eda3089f0fb240c5c0ac5dd80dfe443f14f8b2c2ea8d90c9
-
Filesize
10KB
MD513492d9f6f95ddf635abbc9039ac7fe2
SHA1b4d4d8a786d62dff1f79980f39f985868f9e73c2
SHA2568135db5d84022fee9f8fd5186374c665b87b83a85b547848817fd33c79768272
SHA512ff10e96e89e6fd3a84e497749961673775ff0f193817a4b639fe33975461d83853ba0972dd00e4dc9861c8543e7d9d811b316f5837678b80b2daf41dce3c2c81
-
Filesize
512KB
MD5919139d86491158b9006b34634fff2e9
SHA146f9914ca3cf288e4dd95605fd60568beaeb073f
SHA25604a61f4cf84f9e93a810206fa38ca68b7746ce3230cee7dff01f18607e93fe25
SHA5120677f74f14eef28a326440dad19cda0f74e55000ace7252eeaea80e5521ab000fae8e3d36a300c8995dd2267914084b2d4c140843c0d90da9c6f0e4cb2d90c7b
-
Filesize
1.0MB
MD565fad099eaafeb2f4e18cea7b08abcb9
SHA13c64eda469b03e674f0bbe6a1663b32f4efd0e7e
SHA2563d4a2bde1545df5d1d9b3533ab8a99c64d878cb76bfeb6b53ecf52e0b69e9840
SHA512e37b9415d4eeb7592121283663cc769d15abe2c93a39c5ad8b32b0bcf577950170f1f290f2fb98ef9b23f1df548ec922127a92b812ade6bcfb49b277d92b8c25
-
Filesize
1019KB
MD54c8840d249930f03604ecce884088ea8
SHA1e04bfaed3059914cda448e7422330c952bc29eec
SHA2560c653bffc29ff2cd14787b2ae65da4b89b8a7443b3589828f26dc0ea14a9a95e
SHA5121e280d7d6a16d9b5445d064b7dabcb87e35be19e5bf74129aa7a1b7b34143b63e0275d5cd75b6760c011ee469d7f83f79b75d225addad914ec50c39ab8834b1c
-
Filesize
436KB
MD5edf9a4c9b8d521d2b4f389cc407ca7af
SHA1bd2018e5ee70dbe5ef207422dd99ce24b874d19e
SHA256918a3998dec7b5f6f86a28bdc49708d57b4bdf90b4352c28c0204cb2a708838f
SHA512b7fd435e735109603bd7baab5f76dda7c445e5e0fc075396cdec038b953b2120fcf56fa6bdf497e75b64a337bad76da14994fdab164cc16e4b003f7b24e2e1cf
-
Filesize
436KB
MD5b029fbd99bae518b4fa57e64e4ffb008
SHA1ad586da91a85d9e36309f3e8813389c61a5411ec
SHA25625c139203b7dbdbf43deaa401c7a56993fbcb609a326f5abc8b7a0fd1352dfc4
SHA5129231e53f0d9a7dd608866ec4d22bfbdb4218fc3d75097966ad1935ad96a24694557350d9c237342806fc647f3fe9c920e9e33993dbc6da75c989611b6b89c926
-
Filesize
444KB
MD5552909b141ba52fc0dfb9bb3c97222f4
SHA1282f45f12cf88d1780e300feb040aea6fca153c1
SHA256662189d97aaac3856a4426ea0a84b0016aa8921d308b14c5d8e549dc7dea5673
SHA5122c94ba5647ce3b8e66721815485041a675008afe3d3fc8106e840d603f7c5cb4995a9296e3f127846984e3a83632a7b5925962184e6f750fb1aac63b1e8f8263
-
Filesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
Filesize
32KB
MD572777340b5552e6beb69ecee50183dda
SHA11ab2fbc0c51dd01d5beba7e5939144a2f069ebf9
SHA256e1802b38cd0e17afe048800dfe32f9c9888596c4e71c880dd29992dd125087bb
SHA5121503dca177f5187ce3c0d24ae0e804632c12078dd5489acedfaa52e8bd316b97df309b5d5d0980de9698df51067ef8743d27cd76d124a5890786acdb1fc1c8b6
-
Filesize
342KB
MD5ee266aceaecb8d1723a5ce6eafae8cfc
SHA15369b7a28adf33e44bb3835c5e62eb3441b35da3
SHA2562ddd34010e03e285a6f18bdeb1d466dc31510029c0364309f0fd0c2742e00969
SHA51274ba447ed35516fe51d6c07efc0d46d7a18f3a0b3b026af2b7d11d8b705b1987f08bf57a2c1f6eee451878b4aa42fcab2d4ba178e189d967d0af0a1a293d0e93
-
Filesize
367KB
MD52c01cfee4fc4b6ba0759280f1840aaa9
SHA1f48e8df472f2932ed82ced582a64a62c390a0e15
SHA2564bd2b6102b99711811d246a9e35cd35c7ac92a562d62109099c6efe176e2e1f8
SHA51231b3822ab5a22ce0ee283dc41143f057ffd195c55df664f5bd550b8402cdb17e4ad01fd672facb343ca445a0d67ac49bfe60a03e99353e4b1fee1ed18d1b655f
-
Filesize
1.0MB
MD5f2bf6ca72c75aae24fb95dbf7c969c37
SHA1b95618aeea338bd43790a7c0b854f51eaa8bdd8c
SHA2564eb865b7a9c0534abb68fd0c9960ca6f39410f48687f55e61f513deafea0fa98
SHA51231ff26c1627446ed241db8d3e7758212890396360e55a45c2d4e0b68508a48ef4ea7e6f59d2fb0e0b679aa7ee7a7b80272be3304b0e1be31a49ecc9cb5f02fa7
-
Filesize
434KB
MD5b4ff809ea9be547240c9b4c67ffda744
SHA1812aed667fc29e15d678d063bbcbd3786cec248f
SHA2568e78a4b04787024f537fea0c87cdeba4bd3b17e3a9572f727592877eb5924511
SHA51287f3be542c5dd13b8805a21f904b3cb12e1a2127300492b7b10c3bcdfb2062b1f8a15b2c4db51f96703b85767a32bd79a867a7b1703849d2e6a1e49713897206
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB