Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 01:57
General
-
Target
2395bd0420e2da5a0488879fbe9338b9.exe
-
Size
480KB
-
MD5
2395bd0420e2da5a0488879fbe9338b9
-
SHA1
b50e534ab4fd248700998dc3dab030acafb3898f
-
SHA256
7333c1f267ddac67e00348ad7f43da843ae7f3f5ea9ad293b3a3c473b7d1f70e
-
SHA512
20864582ffa13ab17dcada0d306619ebaf03ebe85f7f30b967a9dc84e291bd862a5b1c5998c79a24f6919045c10c63761a75c5a217cc7c7ef1a11c544ec6d56e
-
SSDEEP
12288:NKwB7cXAS2USFm6LkKR0Yqmt1hPUnbGsbpnc7OM5/MS7GGAzkLXk8:NKw7xT/LTRlrhYlnc7OM5/MSKGAYD3
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Blocklisted process makes network request 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 36 IoCs
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe"C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TYokcEQg\kyYEowww.exe"C:\Users\Admin\TYokcEQg\kyYEowww.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\nGsEUkcE\UYIQwUYg.exe"C:\ProgramData\nGsEUkcE\UYIQwUYg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LyQcAEEk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\ProgramData\ocgAMwYo\DuAUYYQM.exeC:\ProgramData\ocgAMwYo\DuAUYYQM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\euwskEwI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMcAMUsY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iioYcAsY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwcYUoYM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TcIYEcwo.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
- Modifies visibility of file extensions in Explorer
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IAEMMkQk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wQccMcUM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Modifies registry key
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"5⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b96⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWUoYIUs.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SeMkoogg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyosMIMI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- UAC bypass
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zcMgAkQk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HOcYwAUA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vSskIkAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUAQwcgc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIkkUooc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""7⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f7⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 27⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 17⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"7⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hYgcUwAg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uQcwgcUI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SoYAggYM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZUooIUgk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqEoEogU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\heQwQoQM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGUsAssM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YQooQAgY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGIAYoUY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hcoocMAg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqIoQEsk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SmIIIYck.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jqMgowYM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dmUcQAsY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egcwkwQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Modifies visibility of file extensions in Explorer
- Checks whether UAC is enabled
- System policy modification
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mSYMgcYw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwwQwAYA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xikIAQYw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yOYAUEEI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEYkUQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKkYwsYU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMwkoQAI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rWAYkMsE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hwMYQAgM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKAgcIEs.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sskYkIAk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uiEQgYAg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- UAC bypass
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCUwYAck.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"5⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MEcoMoAU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\haYQUcIY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSwockcM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DycMUQQI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iUEUQUMg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cekQEAIM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MiAEgIEE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NYswQocU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WcUwQkkw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rUkAcksk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WiMMYQAg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vQccIooU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKIcEgAE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\roEMQEgI.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gwMkkAYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HaYsYgEY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b94⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vgowcMUc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGMgAkAc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sewoogAY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"6⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oIAQEMIY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zOsgoYYk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FsgEYUsY.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XysYgYcs.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SAQgkIMU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGMsYcIg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hGMgscco.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""5⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs6⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygcYYckA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKgsosQM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PYkcUUgE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lGUgEokM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eowUIgQA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIsIsokw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b95⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PwcIYUUk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lQgoUUYU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- UAC bypass
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rSIAcoMM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FaQwMUAk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zaMsQssQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yCYcYcUg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMMMwUsA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIsQUgIg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oAYIkQIU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BaEYsgwg.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sYYAYEoo.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QqgwsAsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b93⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NIUoAoks.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\imwgIQoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RSwckcgw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- UAC bypass
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JCoMUwkM.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PsEwUsEE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DSEUcUcc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b92⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECYcsIMU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgQwkAsw.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lGcsskYk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYYMQgYs.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HWEosQYs.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swQogAMA.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RsUAcssc.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 23⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 13⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSAAQgow.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\piEIccAU.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- UAC bypass
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aMsUYsMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\assQoAok.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PGsgcwsk.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCUMMYgE.bat" "C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b9.exeC:\Users\Admin\AppData\Local\Temp\2395bd0420e2da5a0488879fbe9338b91⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
- UAC bypass
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
- UAC bypass
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1020KB
MD5afba4922f12866409477f39f927959d2
SHA1fe1b32e9dc52b5a70c4c601955f4778c48f23212
SHA256ae08308c07d22aa959c2acb0a8f605b3506c1c71913e7a25f46e8de933cb6837
SHA512de810959ad7eefe5bf78019e7c0f03ae4864431d6d78188897c42f32cb8f566728ede2a7dd3934bffd12099d77e838cd4cb214846728574a2db8708a64b4a339
-
Filesize
433KB
MD52ef6c25adb4034631e1bb80bed6b9b09
SHA1a828ee8b08df2c0b36790b73a2ef8b62be5262b6
SHA256b3bf4f0256cfa0e9c5a5dc794108267ccbb7b046500461570bfbaf9130f3c63d
SHA512d223485495a88b89b177b0570e77a361f0a8db84f8490716926fd5cd0f64d4d50e2e2f5544aa60c8f44bbfdc2c3f5a03d6e83dc2054a2dde43ccc32892c86fda
-
Filesize
98KB
MD5a33eb62fc4ed553881c16fbf2c3aab17
SHA17d53000e63431bdc3d4812b362b07177c3da7cfc
SHA256e122876722e7ea64fbcd086316231a3e77bb649ff6facd7950326e5787f59960
SHA512b4311d1a43718204181e0379f27e8d54eae2e839f33fcf17562c1a375408abd95c7f2884af2b26cbe9de96b196f85e70f1cb3ab6047c668a4a0ffd5b50c88edd
-
Filesize
65KB
MD51a6143fdafd09a88a62e81718f405132
SHA1bd829220ed1d9ad6a31f3b9ed32b75bee994294f
SHA2560d09522ed1a311df90ae76a8eb5d28c2a642241ce4491738e4ed5a71f2cf96ff
SHA51214b82fa1da687ec8ffb41b363d9e5f1aad944977bcfe5e1e47ad889c488d8128a12c3a85b8268eabc4a91a89941bb910c0de332dfafeb5c0d4e72c964f5ab35d
-
Filesize
92KB
MD50a2c7425ec521462a620f3bf7a79fd31
SHA13bf6dcab315ca2014c6e9eb85f93e140df7f71b6
SHA2566741ac7ed5df7423a7a19314cf28ffb64c181c2066954f2a7bd7b031ef4a2286
SHA512e8c8cdf08d10dd60b23c87e01e79a57e8133417be8c9bb88e5c7875ffc5ee118f93d77840a177b5d04eeecdeb4e5141fd4cfdef34e18b11d35644086cc811ca7
-
Filesize
440KB
MD5a2b9d78ee237462eed4d8c335ca5429a
SHA16f9c932dc27ffcf77dd4903cd7ef2fcce65dc1f3
SHA2565e3bd8eed8141f21b4211a58da4877e44eba3bc933db195cc429fc869c10e717
SHA5128833cab90baf9c484755bafdab87734f4fbb74670876127f404248ecc2900bc4f91a5643534832521c87933f7495d41335890f636045c0256ea0287d2957bf3a
-
Filesize
438KB
MD5906fe1e1dc0073775d254ba7a46fe55b
SHA1f8f1dc5702564818510a5cbbb20bf25839b5529f
SHA25669d77b1d28f43337f32d2d7f9bca5ac6261ae983aea034f71cbe026999984c38
SHA512a3005a2d7cdea8f29a6cfa9c0f46c1abc5aeef427674edfb41b8d5732fc3767658274bae1f644b027fb3abb3387301d01fd44dbe74844762cc9ae0d9b6d7dcf1
-
Filesize
435KB
MD50d89230264d89d78d4cea806cde2885b
SHA1f2377ac6b7781b13253888ae730a81f28dceb37c
SHA2567ca747dae3a821405f1e9e98265a95221c3aa3eb0c026f08b75195b206137cbb
SHA512938f5cfba6b06caa796681777284f33c249b32d5553dddb8321da46ccd5d04ff9c8d727de7cb20c27ba2618b11202fa93f4c934df4645efd71e112596242c511
-
Filesize
48KB
MD55bbeef2274e18d8837659aff869d8f05
SHA1203f71f7353bca2b6f6802acfe7c7f39c1be4a48
SHA256f120cb4f7f7539412edf4e4c4fca3b5666e2dfb3196e8460584fd6c9a073265b
SHA51272212cfdfd61b802f3dc0854223d975260392dd4e78b8bbe0ca8783ee6bc8c71bf35e45e971443cb86f7a361c485bcdc8c464c83d64e31253b1c56d34ccfab9e
-
Filesize
433KB
MD5ca78a46840a5808bfed264af1f2514c0
SHA18529672b100af6afe8202a93c7a60ce68d77f4a0
SHA256f1c794cb012e1d54e45ad1624bf5378bb2fc08da3d50ff2b2b21a72f62f1dd0b
SHA51283ef292e52469d94bc309f7843bc17106e257b8bc7c77bfb3c54d0a0d8e6af8d870977fbc86577e452a4612f736348819ea26b9fb0db0007d900a164f4b6b731
-
Filesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
Filesize
886KB
MD5043d3b765f25e2b112f12af225e17692
SHA17416f3a3c5fe220b3011b113ddfd7e0cfdae9fde
SHA2568855e900343a584bbff6433e861480aea37119f15ecfce104037e31cea6bb3fa
SHA512247c89cdc0c9527068d6e8e77fb81d3c9c54a04d9c6b9c71f6978225d54d58fb3627fc45161a72c7e9518b5b70b81f18b261b6e9ae91eb0638e17ace962ef416
-
Filesize
5.5MB
MD5d8ba4b614a234279461515ea76df265c
SHA1cdae0e6431bacdbc6215cf7e5c6ce0f7ee93091d
SHA256ebe5473b53c1ad145c2e18dab5757185c8f1cdcd7599b27d3133929f96be8f45
SHA512b88a4089912ba9193d99bed3d973b0a3827c074cea3b622ccf06658d6e6626e7643c146c28d7bb9236260e0e5ea16f83ae6c9c2ae5a16fe8d1101552faf74d38
-
Filesize
1.0MB
MD5e3a96da978fa60138d87c15d62470bfe
SHA12d606edd98254e75a0a8fd7a0dd65376fe7393ed
SHA256fa6e6f801f59dbfc26522353bde6acd6de90932d9780ad72bbb8fe267166b249
SHA51235168803b55cc4255ed117e7658a9fb0a1e505fbb2c5b6146c8aa7335c715fd83524826f28f00378273186fba1004ec292c8f5cffff9dc5de76639d93b839e56
-
Filesize
445KB
MD53b4e17e28571a2c91adf56e2ba78e276
SHA18fa1540544d91b9a6fa3603f441bce4adbb1e0d8
SHA256292641afac54c21abdf148e23dc86fa2c7ac9e1831ef53711243cfd7d08fffa5
SHA5123a60c8cec3faacca6a576d8704409f94ce26eaafddd676c9b3ca85960317901ebee7bfcc18b2f2bd05ad9d2113c17ec4d9b103b325c5b576ea20e6c90c6fab43
-
Filesize
436KB
MD55890607d2f7ca66201affd0cd8086613
SHA1feb562198ae0c25272ce2fb1a4f873cbe14de5ed
SHA2560a1d2ec9415ec16de7cfefb07d460a426dea5bf7339d8058e9eca875619ca8a8
SHA512d1d19d25c28d28a2caedf19ef9dff036096555631a409e40e1470913b31533cac5015178406fe26906b5f38cc468a49903829d3de91f7ab37788ebfb837aac4a
-
Filesize
474KB
MD59c9be72612395bbffe41ad9f3d88d73c
SHA1ff5119b9254dc706d4bb96ca81feaee4c5dc0bfc
SHA2568d1631275dec6b5bb65a588c3b64d09d0da5dc266e962afce316fd684652c495
SHA51245d417d0a9b30fc8492aa65fb8019d71f38dcc7e4b4bec432b9b3a86ee92ddcec8d78a5675945e7c4df7c80390aa726bd3c349a00684494766dc5541c687daba
-
Filesize
442KB
MD59a581aada835731bf9b3676b4cd3480d
SHA1f8ba802c654213ff7e7b3ccd01ce2431d1ac06b4
SHA2566b7c28ac058e1c2aa6dfa26483b566cd494343edef0fa40110ad5cb2153cf815
SHA512e457b93f91d0fd967c148c7cc769eb3ac9ec9fd97699fda72ebc6f7601c34e45abb330304dd76a72e9e82e8c2dc1c5feac908eafcdd7e260fbe973083f010c1a
-
Filesize
435KB
MD5b97dfc3e1339aa54baeeb30a1cc3db90
SHA1d28bba8642cb3319b5a960873b12d60f998118d7
SHA2566867d066f0b995266d1e5f93b23fe0f781501a9e24090711f38beb1993571439
SHA512549b1c7c21a0196f48c37a19671c32d4004adcfb5377b7a72084e444b7a46aca4a6d9bc1a0eb35d8c62b3d18e0a6fd3d22a4d5b95a2cd541d3c3587cbc2f66a5
-
Filesize
438KB
MD5be2dd275b871824b81b945d24876e17c
SHA1a10c3c4001a7de647b8727304016069a5ff8623e
SHA2566bd56d3a91941eac6b6cf42af4e978c8d5bfc0a1cabb45eb6e4184b17c2e2185
SHA5127305b95a0870f96d39d0b7159a6fa16c18a308109133dd27ea1eb2411b719929f2597c219922edd7b0d85d5a0d04e2708ecd6eee369c889997dabcfda835539c
-
Filesize
499KB
MD5196b7ff22bc08ae47856ff3c18d6e7ab
SHA1b94fbf7cf47156c1075f2cde8667bb5adbdb3d10
SHA25683d54c041bf98b78f0d119e305e700728eb1c076dc9b49dd402f68f41b65e4e8
SHA5126c21f06a1013ea26b6327b62487117b5b282ade55f4302c05c58a0fcd76f18b259c6e611bef490b9135fa0de9e26ba332c3a9b0b6f5ecd78a36c0627f74cea58
-
Filesize
443KB
MD5f3deedfe54ac9c6fa2ee6b0e7b4bd790
SHA1420264c8e9730000d2cf9b95e7247de7f193fd00
SHA2560d0b20adce5e19f245f553ea6996ef9d3aad17cbbf12ed474dfcefcc659a8bf6
SHA512b26626061a409b365459b0dc85bf658797cfdda88129d3ad0aae9cf509b9529172f78befcaa4877e7e942152720bf998b3cd343130825d38b2e34008ee0ddd67
-
Filesize
886KB
MD5611bd9035422adccf681beff15f6e098
SHA181952571e32a62a51004fbf78bedbd2f13ed670c
SHA256372159c1975d3b27ab374225ed1fa0b9eddff08a9c7c160afc00e23f3d446e7e
SHA512accfc2cdae666a60eea18785b01a60881a61b6e85caf403dd1993732e0385a57f37cac2a048c8b9bc76b446491c111ff3ecef1ae80a69516a31d4b3f85c2f89a
-
Filesize
441KB
MD526b24f261db6325c67543f1481e6c0db
SHA16c64f5f7b1563c6954b467311ac98df7df361723
SHA256b9ebc128aa225f2863d2105e23e81abb3f2b02d6f7d52f1a910cdbfcf18f4a56
SHA5120ea9f146ddd2ef1b94426ba88a70d63b88d4ff1834be1e930d23c94963b8c500a8f8b9b75a2fd27839b23f6da3e22718c3f58af8601aa47b53ee02380b685e76
-
Filesize
445KB
MD5eeaccfa1193eb82480e23c056115862d
SHA10e28b1dfe639a7fcefda1e151dbfed602f08d725
SHA25618c14300e1a59f5ad78dc8dc93f726991ad1f81f54c6a48a529d043a682424da
SHA512027e016640e15682f6eae99b50645967d033af4fcbcf5ca1859815917d882ad840841d651d149b3721327636c42f49e138431edd68c8adadbb2ec44090fda121
-
Filesize
441KB
MD5bdd637d264c521bbd59c89e5d1a00006
SHA1d4e5be2e51c0ab7fc2e597b6aac584c63f5bef98
SHA25688c2a8d11b55e268e9487b262c062d1aa450cecb947117549bcedcd4e4175b68
SHA512a349f539c8c354c824ecb3a36bdb6fee7ef761ed5d9c3546029be94fbbe2abdc5d882812bb5de34656475b8353ae5d07a3f32ef1537ddd58b445706c212be73f
-
Filesize
435KB
MD55df81072709685c3be408ba249683479
SHA16d51dfea01002f66f7b5909b018c0a3fe3178027
SHA2560e80898a35407adb1ddce95496b421ad00975971b3916e8a56471cbe103b294e
SHA5121df8c7d0092ce80a5b537c9f73821fd80e9e9c45568b0b7d902ed3bf5e2f2e9bfec77e49edc15bfbef5749e615d6f6d2158bd00322d8780afba397504cd0803d
-
Filesize
450KB
MD516ce72bf4821645fcd6a9b80ce48e676
SHA132c9a2acf791b6ffe4b5b7263144c448d94af426
SHA256386afadef0b9c55e6d393bfd57a5f40a383cfaf556a9a2fe58c7e037cdd2dce9
SHA512cecfbea05b7ab81dcfe524a5b2cfc4ef5cbcf1a2853e96408adcc9d4c42a5a83b90e8f1c5d415f9bc63fe7c6e0171750f802e67591206633fb7e53190a1581b1
-
Filesize
434KB
MD5f56f38d2fbcb6970326d8990dc1bbedb
SHA190baf48c05dee0dd37037f4a30d447aba9d29d7c
SHA25623c564ecf268c5b73b920ce3a4df25bdb687f420c26743875a2c790a46d23e99
SHA5125bcad82338d02d5050e9df884e8c99316bf01cb2565f4379e26ad5811bcca17a5f13fb56910298cab0df19008d6ff7af55523bb775611f1f590cd3f29517a326
-
Filesize
461KB
MD50c59c69afaa2b3bcc350425a4008ed46
SHA1387e69019885872ce3c475efeebf35c42216f4d2
SHA256e733a264b59f347946ab6dda0d41b7196fd206a1314357dda7911fa9278b400f
SHA5128094c14632f14caab932f97719292938ced849c6da58f56b2c4c386eaa392a65ceba9e9c03b45ba0e4d9986477640dc3284a06de815f3c0702e32a8ee9615f53
-
Filesize
889KB
MD5d67a66c3ca863715eae647d46434e5dd
SHA167731a4ac2af8214a9568287cb0f95e77ddebc13
SHA2561f68c48b73afc5c16c307d504c7f14112113ca31554023271c0bd9bbe0728f3e
SHA512b5e2b92cefc6481d924e606be94c34a50fa31dfc1fdc708a5eaa9836932c97640e4791c462dddf66217dc476f9168a6825412645e5afb68b7fc2eb44945a973b
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
809KB
MD5dd149bb89c85eb63f46b83b8c0f9506b
SHA1e955f5b803e7a0952db4bcba6f5b7908f5f39f70
SHA256d623a7df3f445107722231c54f6be73daab4bdb36da7b3185c63d86e035e333a
SHA5122c555762dc90fb0c22a3b65ecfc6f4fd2d29aad8e40944803b3063083e184d792c2960a9542a025ce776a02fcb25824e3e0e47d196943a40a16595c4fef5288c
-
Filesize
440KB
MD5c5163fe9584d6dca6162e6e3f6254e51
SHA1b5edf1226630fc256aa52e21b77b8cb2bdcc4d7c
SHA256689532af087f4b203e7cd585a7ed28b6a2f4eee2b4c7e55d7d55be7ead4a2f1a
SHA5124522bebf65eaffde0a1ec7dd1f3441b358319c6687ba6d72a8539ae23287a03ae6c6d2526278e70fb9123b860bee236c27df057c337ef885e829b80de9fd9883
-
Filesize
1.0MB
MD53a5d0d3167e52152dd62cda15d0bb553
SHA159500b455aad3bbeb5e4c19757df910c869db7da
SHA2563e488e72dbc17fbc9300d24e4c83370349007a4fd733be439aad772edffcdde4
SHA5123864b76f4fd4196c0307cdbb4b17c882b35b5d1bacf0f72efbed70cbdd6f8993d890d4c8b03c7716ab953bfba764d8991e1892083d16a7b483d732827f4d73a3
-
Filesize
1018KB
MD57d1811e2e97b76e3b9ff56a9437b96e5
SHA1a035a2a45a9b10a24039c1461cc9d9afe958c48f
SHA2562c18a403c26b08f86bcbebdeff5ac0225a30d793cad5474f35a98dc046f8ed17
SHA51272b739731b0a05c56017fcd7f1675c4049be10198da922c7187077c9ad6e5b92713b28f9ed3e47c15e85e06470141f67f1b97af9b69dfa9a9e97402fe27f9d70
-
Filesize
436KB
MD5e7579fe640ba97a260b3736a39c9a678
SHA1a13cbf71d09718f1e29eebe4346f48440030bc5d
SHA256a906038952b8034fc097db7cce963218668676af5890eb0ae71a36f7c8e58ec9
SHA5129944fdb8b6e6149971a891a1bcb8313fe703f5ef305f8de4b4c59f55e35654c9710f11ffce03d1f366118c8b9b5ab6751f7cfa5cffa21a0878e64b5b6057db9f
-
Filesize
565KB
MD546d60f0b255cb6270dda9f823fba5647
SHA11230337cc7d052ccbe56d1de9c45ebfc5c31556b
SHA25666ec7c61de4f6d62f096b5655934d61205a2cda74fe523cfb4c3298db5190806
SHA5120b18534de8fdcc42583ba3517d9e4b3a49207306e059a8b8ecc119c0816ce9044f2cc73817e9c92564e5fa910ba63cc022f534d09eca67071bb8ee497d704a1c
-
Filesize
874KB
MD5ffa6ff4d010d10f478cc8ea248d7be97
SHA13fa04ec7e4b1544f7060957d9a9fb43ad54a0a6c
SHA256ad7fa4feb797dbdcd1cdc25b9b19ce5c72d2c7b43e1a03197e31070f4122dcc3
SHA512285a5409daf5722f49c744954ab10ebaaa0ab15e51be227c212470f551b4c42175263b4fad42e7d9c72b0f0860630e66246ce48dcf2225bfa07a79a4a56b44b6
-
Filesize
432KB
MD51e864b04eec2bfd8d1c2e766e2ad0417
SHA1a7bf1a09b513cfcb2ff7faa7aeaf981db55b187c
SHA256e1a70e77539c27fbf2253e20cd0d7336157c1e5fa21201eefd6c3704bd4606b0
SHA5125a08ea477850d30ac397263bf8d32a6d6aebc8adf0ff51b8236f741e4e653555f1cdc35b6d93c741ee924757ff300a01fbbe618cdd5b7d2de67843a51cba9a29
-
Filesize
6.1MB
MD502675480c13b31d24c8ccd7aa3ba7df9
SHA10d1639f9327526807c2ad2a9f79dea77f998ad26
SHA2560afbd34590498ebdc6723a88efbf376555e22e086ea2ee13544ea9404c50e175
SHA5121bfc4031a13e4d099c8563ef3ebcbac896e5f7938a45e1479f58f0af115956a10c6b49bc76b1c8fc5c453ca13ddb2f064a21966b896c344b6d6e6852a8b0f255
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
