Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 17:36
General
-
Target
2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe
-
Size
209KB
-
MD5
bd0b4c1285f94222c22c6acfa4dc9384
-
SHA1
056a7c7c8e33a2adf4789ac00f59c35cf3c4e783
-
SHA256
b098e7888d8952873d9c7455f548313596c775eb6dfd30f3971ac5671f61b5cd
-
SHA512
561f87b8191a100965b1cf92fbb99cd79d64f69ac8e20ad76a8b0cbe279885b5c6e1519046e1242e72576932aebff329994dd64d22f2d4fc6ad1d23e1d41afaf
-
SSDEEP
6144:nbbgxfwyn8Lqf2yb6TfJBMWe4dD+1zuaTd7OrwmdsHNP4G9N:nO8LFbQuxMyqJ4GL
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 56 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\EWIkcUQU\UYkYgUcM.exe"C:\Users\Admin\EWIkcUQU\UYkYgUcM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\RwMIUgEs\IsQUUUsM.exe"C:\ProgramData\RwMIUgEs\IsQUUUsM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UygwAQQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"72⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uCEIcUwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XcwwsUQY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWYYkcck.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMYIMQIM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQwskYII.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gCEUEQgg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yAIIwsIg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEsEMAYE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIcgEIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\diEscEkc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pEEcookE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eqokwQQo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQQoQsoM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vGswAUEY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FMUggMEs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGsgIEUU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""43⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs44⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f43⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 243⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 143⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"43⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jeMYQQsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xekYQwwU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HIMAwYsM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esQokosg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EOYEcQQM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YGcEwIsA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KkcUMgQM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAUAkEQs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgAMEAUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSUUQosQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AAoAgsYk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sgcIMEAI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KsIkEsUo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KcYwcsUU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEMoIgQg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYUwYsEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZqQoYUsc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lwMIAQsI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IYIkowgU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OsAsEcwk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"4⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock9⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"16⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"30⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock85⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ceQUAQAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""102⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"102⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DIwgUEEg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TKAwYgUs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hYQkAIgI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fcMMskcI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock96⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qCUUEkgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""97⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f97⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 297⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 197⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"97⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ooAksckg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CEkIAooI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEcAMMAY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NucIEgsM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"87⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock88⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"89⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\McoAwskE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""89⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs90⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f89⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 289⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 189⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vGkkQgcs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAkMMwwM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV184⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMAQgkIU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""80⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wOIcMIsA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mUUwsoII.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fMAgIUkc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dGssgUUM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XEAcYcgY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\viwgIMoM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock69⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGUgwYQE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQsQccUk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SeYwYMAo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgoYYcIY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMUUkoQY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pUAYYAsg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsUgkwgA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VcUgEIAM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GeQQsgMY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KEcEcsAY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKswYEcY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GcgcIMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HyccMIUU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gkooIAgg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""42⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"42⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIQAUwYU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkcIkEQA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RUYgIEcc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgEIUgMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GKAgwkkw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKcYQAoI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYUooooo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqsgYcYE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Checks whether UAC is enabled
- System policy modification
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lqkowUow.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beEUEkEY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xgEgckok.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wsIcIIgE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AGAcwYsU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uGYAMgEA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zckIYMwA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NYgoYAEg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies visibility of file extensions in Explorer
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lYUMwsUs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMAocwgw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeggYYwo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cosQQksE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"4⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"10⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock25⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUAgIcAY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naAsoAcs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogUcYYow.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ykUYEYIM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"22⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GswsQwwc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\keAEAwcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmkYIMAs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LwEEkEEg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"16⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"50⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"52⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PAoscEoo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""52⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGMoAAQA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""50⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bUYAsAcU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FugcwUAo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV146⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs46⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEoIYAUo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iyYEUwUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs42⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eAgUsMUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soQIgMwI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqckoUoM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NucQsooE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
- UAC bypass
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSAkwQks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\daMMQcgA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AGQooMQY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIQEgUwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUoQocsM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AsIwoIIM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKcgcgAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hIsAAwwI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rEMkgUYA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKwMoQEw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HSMUMEIM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""13⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f13⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 213⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 113⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"13⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lWcEwYks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zgccwwkI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vWAAAgAc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MGAQoMkI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eOMIUoco.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wacMskoU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 25⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GcUIIYkE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OigEgwEo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IqYQEgkk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSAcwkgs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VuggkQgw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"4⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock7⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKMwcQoY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esAUMscI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XisEYggc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tIEYYcMk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 11⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"1⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs1⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xiokMoQM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock.exe""1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-01-26_bd0b4c1285f94222c22c6acfa4dc9384_virlock"1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5780f073ea9ed1f2fc456c760a2b7f15a
SHA1040fe4c817fa9f315181703c82202bb895b6c2f0
SHA2567a3a252de537634f6d6a14355a0b7ec89859c38bb01784a765d0633accd41e40
SHA512b9c18165d81d35dec04bf5c517f9557d1d8f290a7b88392eaec387efe33c5865968e0d9fad76fd4c63e55b53dc57284ecabf56fca86f9d9088d7323427f64f67
-
Filesize
219KB
MD5cf6018e25279ae1881f88a9ef56b9e99
SHA133f3d1d193a7dbe7ca97bd535e5192aae8cb3a8b
SHA256d7c3ebafa4c184e92a7df4a17504cb3a627bec80e2fa4c4458c71ef0b72a77ac
SHA5122dec978d9f8862dfdb575d2960ba0bfd985a8bdf841bf72745486b8e4232cde1b2612944c69a61b7cb102bf3904a4672aac0a3b8bbb51f1713ae1123456cfb77
-
Filesize
773KB
MD5845a570c7a07a4306e94315bb1c48654
SHA142f816bdbdc9f0b4d325220aa3ccd6c8ef3627b2
SHA2566ae9160f9a3d9d94c567f28000380a130d09576d78c41e9ba2cecd985cc90ece
SHA51273f599f1c76b7182a92bb4656d4a666190d8ec4c18111242f5b7d1de9b9b8f05562d4d5bf16ea867f6c8530acf3bccb2066396926838020db9c75196a89362e7
-
Filesize
826KB
MD54a75d671cc9dcfe8a6c4a5e45defb1fc
SHA1140be52a0cab8c27432a5b4e4c2ffae7690e0e40
SHA2560729d80aab98a1c875cab4482ac578a1b6e5a1be5120656f1cf088b8176ce68d
SHA512bb9076b4d65df0e0151895a2b529f92509477a82006dc216f2f3d63a64c7762d1ec3d58aae3cdfd251ad5b7b2e3ce0cd64148e3b3e84937a06a1d7e02bcfeace
-
Filesize
637KB
MD5b1d67b9c411f1b8baa835c1ebd043479
SHA19eca64cd3e1d53adcb32e5dc4ae212a61c81542c
SHA256c3109ba6cb5b416a2180ba2849c58eadf6b7ea44fb458e42608c6421343a6dfe
SHA512b16ed0cd2c68d41d76da0344109d626b4ae9bd6fc082bfe6ad40e9cc13e7f9a84a036fa9567cab8fc475999c75497dcb460d1a6c5ff104022efbf71288d42eb1
-
Filesize
178KB
MD5f8f14a2eb643e71b9f938c83cf154926
SHA1e1c86f23db28e0e179c45b15607260531789fa7b
SHA256c9f9a7e4544b572bc75591dfcd3819b591fc4fad4a50748bc2794253d6de33ed
SHA51222527ea9a967e783be30b329ce0ffab464e4d8d7520c3e548b491e90c0685cc465a68ebcb80ef5bd1d580190b07106e7149365592dfac774ace690c480f9a711
-
Filesize
4B
MD516cca5fccf31533bc288c5ab66be8d0a
SHA1da7948469c33c93207fae73dc97aa94a2cc42f86
SHA2565b77b7eb0f14fd8bdc2a07e6293ddab567fd80804b8ea2201b7c69917e8cade6
SHA5129861b965a8d42769503aa1578a5ff69e7506178de85c5fe08202ccdf43a6a4707ddc7f5630b3c2ebb5476d13e77014816d634ed164ae4fb6302744a37313f229
-
Filesize
193KB
MD565daada2a7e3f48ee769a6fbd0e8c390
SHA1635f1006acc11aadf9b0b16744079838f50c2cae
SHA25692299c9a43d1d4a97e4007895199525182b9429dee8172c3e88c1ca0f9ac6903
SHA5123019df80e8bbc4d622fd3a1b92c3e3b2ca5493794fe8ed69c05f1e9827a22f74f3f711dff7fe32fbf35e08a8d5da8f9885b97b4ab82ac31ea4bf65257f9c58f0
-
Filesize
187KB
MD5cab024d918f172b94e80b72b7cf24753
SHA10a6e8ea2a8413b968d2ea9edbbc36b712598b1a3
SHA256242bf72bf631e1b7e8ddb2804f8fffa3654f728f7e950c55c821f0ec29d9c9f0
SHA5128bacdc66cd34e4f9dba8e24c2777ddc8952c690916652f33c18ec0b703ee0dfbb4e2d99d1b580a80bb01421b5eafc5d58511ff9fa5159e7361196dcb34298b1b
-
Filesize
205KB
MD5590e8feb100e279fece530f229882e8f
SHA11308b6dc68d38f6a3d8fd09def262b23be8a8fe8
SHA256c2c91f1e54d9d5c0ae7ce03788d9b39a353cd63dcf301d6e210e7932c07d7852
SHA51292bb998ae5194632009309e140b2e040f4257ab990d03915ac350186de5137f70ca64962b387a482653d5b5d24bbaeebd6a32a7b222212f2468a98c98bb3ff61
-
Filesize
191KB
MD5f4444b8cadb8bc144e8f2a03f9c1b4a0
SHA1aac46f6c5865e3bdc8641a71597aabe2a23192aa
SHA256e4fe4b34890ad1ad2a20cb5ce469c4aa912b77c0b305f388ec0dc634a4a5ff0d
SHA512bc2c98247ce93f31b1cc34230a16dfc1cb7fb22366b5fe9f98465b58950c909e6104571a954de5138603e91e5363cb336702e4fbe82e1b4f858cad8f27ebcbae
-
Filesize
202KB
MD57f2d2492675d6dfd8a55723ebd2c6556
SHA127da539d827beb55ad4099f8a1e168e0b22107af
SHA25624bf15a510d4e6220b0521a5256ffadf7217aac0bfda3762c4cf9b4bb6f838bf
SHA5129a176312e7782472244ee83c28482e9fa5f4aaa480012af371de1a4d333365c0b72c8cb36c56ebdbc7486394d6173d454a0fddaeca691fd7035a1fcc4b943c60
-
Filesize
186KB
MD5cb7b1206047eeddb6d21dfad02751ca6
SHA1ba18d2c01a7be625938e3ba610a56fa8d5ec0d9e
SHA25623b648e206e4ca46b568416456f7bb0d32f470504af2c42811b07f454f8befed
SHA512363169f3ae413bedaadc87cf251d451366a51378f936213a2333fb22a22c344e4e26e6fb723071c651258c74ef1d156b9dd60e68ec36d93b23b7412549fd7b17
-
Filesize
189KB
MD5d25d350cc9f6fccfbf95f4a374b0889b
SHA1b07542f2ab684be240e0fcb7530c429fdb61cdb5
SHA2563420edbcc0f51001e4ad61e049cfb022e66da7fc3a81ebd88e19927f245f3c1e
SHA51259c0e4c16e38b704164e39713b7d03527395827104ae6cda020c7435613a112b4371f3c4bb2cd580c7f1e9a5c3c5087ac95695569b9b2465464045563f5208e1
-
Filesize
204KB
MD5f5d7d994f9e2c15f488694e51196f644
SHA131120dc9ab1d20a43bc2e2c7f1102ec7c1c65b31
SHA256ba33caf9de06ff89c7fc50654d3b1ac02cee37f09a2285783863e988681bd3c6
SHA512bc94555c90a6ef3dbfe114775d8b17949a8b851a94175e8a0ff9044fe028ef835de301163def488ebd8ba0cc5a937c475d6940c22278937e3246f628229da176
-
Filesize
194KB
MD51b986db65e237fcf3d5a8ce878766c39
SHA1415ceff15b1d2ef3e68d121719117a87132f9287
SHA2561524c8a679b2d9d3fa71a231ff2c344f00fdfc4bde9e4f7a5090fc78549c0067
SHA512a192b41d6180ed07773f224a5e2da40cab06e2f226edbb172ff42c98e6bdcc48472daa8d1c79dd9c8428de4af48c047818f74f30dcf36b748d8e793969ef59e9
-
Filesize
188KB
MD5664011d341925fac17d8d158bcc322a8
SHA1ca38e88304d9e71a32ce38acbd24fad8170ad842
SHA256caf454302cd3b143c9e32460346d6cd57759a89c8cb78d5cf6e0bd7f7de76185
SHA512a268e8797e96a19e530bc791aac0b679decf93efdfea8284056e4638552ff2b9368a40f2a84716dc327d31b0f091108aca4626fddcb1c6c70e7090f4559207ef
-
Filesize
1.8MB
MD527bf19f3b8de1a85df2ed496f8496947
SHA120c51200d8a76d102b33919db01691b5b6fe8010
SHA256c7528fa29e67fb76e4764f3f5007f2f35fb8dc23b2e6820c9bbc4da36547a520
SHA512fe6b9652fadf0c006f886d0ecd5ffb318913864230cb9be5ce0c7aa0895f824e6f7a43db3d884077555e4cdd25ce10ada691b9e23e8e6d5bf1270a3af698a745
-
Filesize
190KB
MD5a4431adb7bf614d94aae9496555c2c31
SHA1a785fcf23a9b9c817e4cd2a9557b3c4372921455
SHA2560f7c622eaeb5295feebb27ed673178826880e04544277508a6a46e76bfe2e5ff
SHA512984dc7d8e91a16b44ca0dc604cdcb9136778e5e95a9ebe05d89d93ea5a62c879c977f5ea9916dbbf4cd28d9a47ce0e04268c509b1c6884872a207a963615927a
-
Filesize
197KB
MD56152e2e650027ef4f0b51612241870e3
SHA1e32af900bf61967c44c5b157a5699dc36575ef43
SHA25604ff5bb7f8f83154ea6817211f2ab99e9405e4be17c8fed63e6073af795ac30c
SHA512bfce7714ddaa784a47c94701d81c61f023a6688ac6d64402faa13a102fb36e1d01f5b0b5a13e101b862ee6f9fccaab3a555ed77d879dd7490ef5c249d9a5146b
-
Filesize
3KB
MD5542371981ad5d8ed0b2686bcb318e6ac
SHA164796f5e9f24368ccd58a4f026e4d9790924a82f
SHA2561a541ff5a4c4073b946d414bbf734d690d35cd032f958d188ddb6002587b01f9
SHA512e3aa5121c0f0fae885412ba3a3e8b8cc35b8c0aa69faed21800e2d3f65645d6f836d6f308f5438a192f313b4adc739dc27ff48463131a089378d3cea7cfa225b
-
Filesize
208KB
MD51e2a6063f4e1a95cbef694d20c4fae64
SHA10213b8a07b6739755099bd0ee30372a9c44438cf
SHA2565d45cd0a19c57d2674d64362685b6589ee933d518f1724e18cff22d026fc10d5
SHA51288f24b91dfcf7a5cd0ca10ec793701be8b8a2bb500cbb2c219cc6a436918597f5fad8a53b2c575b872fbbd8459f57ccc4d5806dce4f1c838e703829eb0672cb1
-
Filesize
214KB
MD5b5bda296b5fc8c8dd7134bdb2d2c0f78
SHA143b90b7fdb16fcce80ebcf58ca02d3447e466f49
SHA2568afef9aa3c4b2a777a9f8b381f230f41717831c64b64acb2f0e3a747becd8178
SHA51242d80cd43aa8b79d0a161121c4016acc77babaff52f0bdb4160e35e036e4d67acf76418ce7d8c4040bc1da7243d36f46986af6b58a30202ecf3f990cfaf38cfb
-
Filesize
226KB
MD54daaeb1ccaa41bdc155c55270a530e5b
SHA1eae89a5e436b4753975c94198df19867d56fa936
SHA2568f5133b2efd5f95055311fff38e9331c2222c115fc31408b82e26889331e8f02
SHA51231001585acf8da00b0daee8096ab53e26471c6fc4bd3c958927a2a045052a9dc00e2aff96419f209ff2b5fe8c9c9d74afb0fc4d680310afb8ca866a362fe1eab
-
Filesize
906KB
MD50787be0e338461e3f18d12ea45b9af86
SHA15d2e542a2a66f6d3895c63d580142fbd48f8d813
SHA256798aff2515cdf3f3388c23d0e6326ff6ac2e527a184a15f9cd2b38a70bc3a35a
SHA5124d5c16f7969867d5788eeb9a309569d3f5a8589025c1101022c03cdcef400f867db5b41f1251081926ccbe1ada28ffe817f8fe1b14e797a47eebd322527396a4
-
Filesize
199KB
MD5826e1bef1c2b3f34e258284dccecac7e
SHA1fc78cae94f5d30563b276e99fbd9f37339f3fd8a
SHA25660239589e24ed49e662a8544b12df09872500c044819f58d925e9bffe83285d5
SHA512366effd83f868e6050f4f7871d6e3a601102161568b05fd075054918ad6971b0c57a287bb3ae167a64af38524e9e06f92522c7c10a4421e8288247cabe772021
-
Filesize
182KB
MD51a628ba3c64b849aef3d9b100359b2b3
SHA1648f37ca24196c84fbdf953b71b0f9ef395f1c2b
SHA25646dc676c5583841421d822a31a4ab974a06d101c075ba6d0c486bb0363aab199
SHA5123ae095f3e83110998d2eef848cc1c5f04ee09ae0342d1286e1c64bdb5ad7897da68bca68d482539ed09494c77cbf66c1b46ff15435cddf6385d1b48cf3acebd6
-
Filesize
195KB
MD5c2677076ab70162015882e618652d012
SHA1eb32441afeb9d6ba0af575a5cbde7e321c78a34f
SHA256e1ff3928535cff053c27714b9466d88a74cf9d1cf5ee80e42a639d8653adb828
SHA512d6e644671ecb20806e99d20e04707859ae53890ec194bbe265f3e4bd2b102d4d1320c7c97cec52513d01693fec1763d3c4aca47b6711e93891badf123cfa8be1
-
Filesize
201KB
MD5bb09ab5bebb5581ccb160445b08af447
SHA1bc0110fe8f3c898222dd8095834374e3f54019cf
SHA256ffc074ffc606d6f7625c5c67548f1d840a7f20a3421bc354b601ac8ec26e5307
SHA512826ba49511b8f00af2b6938e34e046f54a5b891db3f81ad854a19797a4f98d34ff558a781ef017e04ad210ac496b63d520bf141064f1bcf1e7b5776da5db4f24
-
Filesize
184KB
MD587957cf78654a127c50ab92a3b39ed99
SHA171d4dfa98e74966bd76795b8ef08a2ce7fdcb4d5
SHA25605a743ca39657ae5521c93640eb788ca498427efaee28da3be79749074a77870
SHA51200f4a555acb70b7338b9d90687a9581d15f693a814cf1ea4b27cb9ec9199a5e428d6c0815914f594ab30401320ea744169b509b2519ea46cb0a7dfb3e62130fc
-
Filesize
208KB
MD500336dfba843201369e3e89c448a41b7
SHA19eaf1aa075e56ea0c5288ad5aeac0f4445d59331
SHA256d9275f503b6c97fd6588f127d9edff78804d955b62197d993ded3de4c8480b13
SHA51269b0587fd61edf85c62dd9a480957aaf364f3cc54f0499c1d4f102116c45c310b28406da3892fe7295a7e3d143c7c0f874aadb695226022844d9381615e6c973
-
Filesize
230KB
MD5a2acf3a5b76533237b5d647a1907aebc
SHA1ff58dfe46fff3115621ce26b576871d3373b10c3
SHA2564d6f6a164c50c6d6d913d6578566c5d2bc479a2d9a8144e0e5b8dd8ea2edd670
SHA512b5b065a9f6dbdda41911dfe6e33df6a676806896ca2caef3d94752e712f9d8b178941c1287d09d44f8dee50c8693995defbccc3bae20b7c69731be2733f25157
-
Filesize
206KB
MD5399e0d96e61910c3028d077c3254005a
SHA155565c02ce4765b7cc440b744b1e41258f7de46d
SHA2566cc2f0d5e397c3df1852b469af820a46599100ca7699afa3a3ad76c02e34312f
SHA5122441fd9e3be3b41f01de69ece13b5b6f0158f00320088dc86f4ec5c37dd12bf432eb14f567a6df3f49d9c7dee1e9b89d4359722fa2c344543b6828c77798b976
-
Filesize
470KB
MD5dc0f1ea5caeb87da978bf44d23d0ce3d
SHA19ec01257d5e745277175aa810cb1af2703a2f452
SHA25642ec166d7fc58b93b9cb8270726ab5f2a5ec94cafce7f984ec43a7bc40a3d6ae
SHA5122da65bc1cabd0d15d041cabd62e44beabf8a4d2732336edb32cc843109984d0fdade2650a5bc04ee4134fa5ce781fd6ce30076d9abaacca7871a86f29ee81d88
-
Filesize
198KB
MD5a302aaddeb4b1f7e4b13bcc00efff8c1
SHA1fe2f6f8c47700981784e77a0e41e9ab4b0d73b67
SHA25660749a30b320afb7a96f86010a5dd0def725683ca868ea09c1d48cf789d989bf
SHA512d18fc1ae42e1bf961c725ab1dd0b0ec24490175d98df625dbc790d3535b927193036759f633180956cf27164e7a537d99684a975da73a2a373e49029fbf26727
-
Filesize
310KB
MD58d5df5b5386ef8fade08981259359783
SHA1991f2c082d4831c4b7cdcc394c3570ab2df11f67
SHA25652bbecc3c31db3335f2dc14ea78acafb59729520966a86e1dce6535ff43d1e2c
SHA5126cfd8e2cdedb0d960488c5cef9a56b30b30b5edb121980ec217f82cb3eb1f3773434bdbd07c383b120c4454fad1af14f0d45939dbf76f9b821f6c266ac3420ef
-
Filesize
212KB
MD5562cdbee36bad477b708f48917670276
SHA1d63c9dba52e553150b96b06995787c4ea4a9187d
SHA256d68dd2dacef8781276b2fa196ebb4b9c52da03739fcd141f0eb07a8e703ae62f
SHA512c4e280cb8cc3710ee79701646d8209c78348770b869b37340841ac66394e8b3eff7b23a7e0827d1d3943992efc59686fa9033eb93a483ecec291bd04e14b1823
-
Filesize
196KB
MD539a2227e041524cd3c7a6d85dc89e7f1
SHA11f393da2c8860ac5a969197fd1754b7c2c38907a
SHA25632958719558b44c864450273195c11ca6d38dde1e9cae2a035b3c1d71cac7405
SHA512a7aed5b1053f5b5f5ca14c30f36ec8a11dda1e10b1aeccbe57ea5f503ca66da0f80ff8849b9fa1fbeb507a2586cccd2e879a601ea708458a1208d24097ab4d40
-
Filesize
193KB
MD5adb80f7c3c5c5770f9745a6d02b8c8bd
SHA1a2cdb9f891ede77f988b3ca0ba0b3d846ab38e8b
SHA256fbcaa686880225bbe6570a9e524f6d19acf1491489bfb4ca513db1af81ec0aad
SHA51245ac94e4bf378030e235906ebb7d8597112cf579a618d9999bd51ef84353118c51c0c9b48020bb74f42682a487f7a4d92b2af20d79e0dff74996e57f4d67e9bf
-
Filesize
647KB
MD5a0da721aab486918e80a2a9209898123
SHA1fd579bd3ec55eca14418cb98110a7be54c71dc9e
SHA256c9169e7eb9cb4f67cc2a8283351fc6c9d48c615c22b77c1b9d664f2f183e67ff
SHA512eab48be21664093d525e9f205a9ca312a5adc14bfa5b741bf741a1c5cde1a9228095b2e253331bea5b3722656b1dab669c32498601a9fb15360f132f5dba2c90
-
Filesize
578KB
MD55599bd5b87801fa579db07fa9d250cbb
SHA1e6731153423aca72e9d85f048a7a222b1449f476
SHA256f698e07b32ddffac7092658bd06c62024e03aeedf72949c83560b6183f099968
SHA512c0212963057ad36ab5634c9da905a041297d46275ce3de5fa37862b9067bbe30bf0bd6c63ea535cf2aec037b464e92be0ae0627a9666acbd9b0ea4c236479fda
-
Filesize
229KB
MD58e5a9b9d0d482fc286c825758d90401e
SHA186473ccad4a244fc391dbdf70d58ce83dcb7aa48
SHA256926141ce264f01d5fe8ef02908961a4bccffc26c9d4a3cba36d64106c9708765
SHA51218444e097c88aec32a185aa289ca12fe129235e7e67cabb74146db6da0267be4586b2c696da28aa2f8c21ec45f9a65031854421fcfedcec73f2a03fd58cb411c
-
Filesize
195KB
MD5525bf7b1c462c31c901a172f1862633b
SHA101b3ab0ea1826c83aadc3bbc8fcc5f40836fd534
SHA256c3d1ac6de53a803cf6dc1e0b503c2cb24380f5a80a7125c9a964ecb1433548fc
SHA5129ffd38caade5b83b129c2813991e94a94023f3486796aba77f4d7658a0f5ebaba8302411838267a35a8ae6b9bb0af44b2eee99d7a01e1f2c29c903dc22843309
-
Filesize
195KB
MD52e8a578eb11f7d962c710c11d580c036
SHA1c78c6768bcaeac4992a86243fc640ff1d2dcf903
SHA2565399332827136fd89d75925be4f83ba24fa91f0c730db75839aa815c0c8c7115
SHA512f3275f168c2a8b53c4992216a0681f4ca7b7b85ea6fe243dd89acb0a492374677616a9ef03df1737098d70e41aa0784500e27a1eeb0e58293e54a1c9868df035
-
Filesize
195KB
MD5aed590ae8ef444fdbd90d70a514bc0ab
SHA1f44b120bc1b13ab908b77385e78f32399a77c82c
SHA2569a5eb17577d2a893633ee871e3cc4ffa8d2df27d628b00c67e0825cef6a49a30
SHA5122dfc18baffb93b146c1e580a8644272a6c85fa29dfd0e1f846343a97cd4652eecf52faffb514a7317264db028527df33a3fde83a1cd006bbe2709d0095ad3099
-
Filesize
2.3MB
MD51112f0cd9afd1b7cff5db870608acca6
SHA15aa1d3399cb91d6c27fdb3e735e6b9340c95e7f0
SHA25694bbf1053c3057c06e587f455dd0fecf81f99a91e333dcfcc1b92c32a013220a
SHA512e797a9436147541f54bf80fd91ff35442d8c9f2d9410c84c08cbe82d36cbfef399eebef58ed57c40376a2093214428207436ae930a2aca305c3babac95faa34f
-
Filesize
197KB
MD592f5687d9da6639b0e58e8e062f45d02
SHA1cd35d386e758f2bf8420283e66038bee80ccf749
SHA2562589909dfc1aca0a3bc1ffad5ec0f932af8d45863d40eca367df35776805a54f
SHA51202932f8292955cd3120e4f7c9bd4fb6def2d31dd8c77d64c1898fe0afeb7ce5cfdc7f6b6ba8b0f6ebf68e2a6c4cc32c16580b1d51a632c2f9ee5470b735ba3db
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
635KB
MD56438df18449aec17bc31b38c4bdd8b89
SHA165611b994e320b8f93c3cf7d93e0028bf664446f
SHA25661f3edac3e57feaa65fb29db8113b44bd684377bb4da5a9dd0addb0a155fcb42
SHA512dcc0e497a1625c13cc9edafd4d76f35e9df606a7e4863eeb814c0f6731446a9bc665fff48c26485b620f4b62b0ed57c1e5a4beae1cfa12642745a819c255edaf
-
Filesize
194KB
MD5f443621818c1fb8b20136f546742c995
SHA1a7d581d524ecc2af8410a29b930bf8598782231e
SHA25613263657a904f3f57841c89de3963f28ae190f7ee5c65d06fe00918f9d4f34dc
SHA5129b443bfbac2aac7f3d945e4a3c3fa9c1caf6b6da751a19450da7cb5b431c2a9b2ebf014720f5d1ebe7408170f31ee81281ffdee13670df3a95a1862e4fe953a4
-
Filesize
646KB
MD55b6aa0df341f46a11dc3e82b01094b14
SHA13b2cf384aba3b58ad08091d5c3b83bdb80a64d42
SHA256db374d66b487799be14b891cf458d5aad250e2bd50ea17f01ad50a88f17eb75b
SHA512fc293179d387a9f9daf57dc57f8b860a22673825ccae6c13d676e5f2bb723b867a2d79d50f7228a7d79577f1c34fec37dd4704b510e876e26294add4bae08879
-
Filesize
236KB
MD5579d81fb031f92c1d48720d9b06e94d2
SHA180500af39ffb5bd177b9aa2f125e0f97bd64845c
SHA25693f32442ba1ae7f6c5ff8a3d855a23582842521e88041df03589cd535c167830
SHA5121a02478adf6c3b31d2795e0e6d5474ca42bf0c9c75881951102385072a885467254d0818a50d7e98944c1d74a4eed3068a94b7d693beeae9e433943af3482c12
-
Filesize
189KB
MD50525f420f36ce75f59076fdfa7ac90a1
SHA1b4825a1520643033cb7e4571a8db674e362f8d45
SHA256db7eeac7ec6e106cb801e56bc580813a6630f8a1e2d2e7e6dee6c46432de8e1b
SHA5122af758ea9ed59756fcf69cdd05e5b26d9e6450d6500cedfa3a443b5c63a9bef7010b50a0e336ea2f36e641bebd420052b1acdc161d1d88bfa95c688307d5c2c6
-
Filesize
225KB
MD5c36f9c3e1a9500a7091bd45e72c88beb
SHA17c49f2345ada95d34c8ad0d0b6f985d0904b1704
SHA256fdedbb71fa6ec02727ab228ee01c80ac2e0d8882d7a6666356369750b069849d
SHA512e6d279a18d95bd4dd31e176b1c8544f2cd0aa30829337ee68322dbecf5709d287d6479a19b85ced8894b3a5601ac327c71eb52091eee97e09b6d14b649d3cc28
-
Filesize
574KB
MD563cdb1e70030fdc44eb36fafc2dab9e2
SHA1e235615885d718028da497e04b7c97119cea6c10
SHA256921f88347445d93508c5e42f4a8d9b5cc04222a3b3228b85ad2b213c690eeaf3
SHA5124c114e3583956ca5e9668dfcee59ef7934ac6fee70d7bf85c30e3fc5fccbf90ccf1ca26f3e6651d9843e1fa2eb81e98295b447bce7f559308994049ec45031e4
-
Filesize
190KB
MD5083fe5d01315105891b734df182bbfe7
SHA179c14da7658636126fa475e52ff119fff9586bc1
SHA256bfd5f7785a75a6ffb6c9b5a337b34117f4fbd1d29c2e2d2ae8eda3ebafc7f012
SHA512dc3b4545fe3805820a48158c7b122c5b9c95a11048d9e95c75d25c1e031e30dc62d949abb1c34db1aad2fa955f45351a1e76ed5dee9b234971b6e9419af67b6e
-
Filesize
193KB
MD54b8dc9bbaf012a493749d71c367ce555
SHA1578222c4f8d79fee10ac306b2138046fa610be87
SHA256cd3654705cb2d065297cba3633c92f46ea5f7b19457566903f147911602793ce
SHA5123136a05cb459b7fd28f74b952938fb26d5ce5611370e18b695d05324c3d298395d4275992e0c5508accfc8f2147ce5add9e4130fc01e5fefde0e7ec224bc4f55
-
Filesize
1.3MB
MD59f935016fb35b62f586a4939e99716ad
SHA195a435c411ee32577ced9a85cb534a962872d0eb
SHA2566a7576d17f032f6368ad2be5a4061d6b51f95fb7e13f761fc55a8c3deb98c683
SHA512b08a2ab8c326f9fb4ac03c1a362aee9686c291f17c329bd41e8afeedb73536240ef0ad5e6daf566bc16279984917a2ad82bcc76c742619d4fed81ff9441da992
-
Filesize
191KB
MD511ec390f89d5b87720cc0120e33e023c
SHA103e28e37bf097625f57ff7ffeead62aa4ce50df3
SHA2562623981d3bd9229cdf3a49f30a9b5d6ceb5d4c9b94298e7a3a28aafb0276d57e
SHA5128d7492b162be19099a55d818570b1d7b5d58f16d24efde2949200e5f18f2be626924759c1602048f812031a41b834fd9f592543d6a1ec4a7236c1d63be534255
-
Filesize
193KB
MD59064f69cc28e49db0edf663ccc4554f9
SHA1955926b5dca94b1f72bada5012d43550267869c7
SHA25666a5845c57969d6a6baf3d0c7b778cec2694b79432417ccf7ed2fe19bf1e0fdc
SHA512c6b9a982e4d9636db921bac4c8aa2f3fc309b49c8cd3fb52f9aaac031ca710463d90770cd363443d27922ecfc7cd0cbbcbe282be204f588ba7a0102caf500731
-
Filesize
4KB
MD5ee421bd295eb1a0d8c54f8586ccb18fa
SHA1bc06850f3112289fce374241f7e9aff0a70ecb2f
SHA25657e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
SHA512dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897
-
Filesize
204KB
MD58e2b6f52d8d2ff06cf84c66b5aca6d68
SHA16d04980a0ee92f5f8f43cc1e98f059e568c0d75d
SHA25602f692f832f6eb641888fa6662ff6d054b8f24ef73483576e91681b78423e441
SHA512f022f4091eaf521b22e8887860fd91134a5e0d1e4d48baabae7f1befc2780b6a720f2b1b22ef7d75c4e1c914a6735bac71b4f79963a2fcb2cc515e7e42021340
-
Filesize
820KB
MD5202e08671c8dbe3eb4500561190359d2
SHA17e606b7ceb4a6d1daafc3f1d07698e54aea43456
SHA256aa5ff668a1667b599c590c85c20a32f4837241257d289e1f241b4350f9fadbca
SHA51212e7bb62de9ff42cd7a2eaab76a56c99101eecf88dc071a86d1ac12d7e424455be6c054375377e8a0538602de1b76e55b92950cc92edcd6a2d680d48ac1d3e89
-
Filesize
639KB
MD57de5e13cd55876e17f4c9cc9a382c651
SHA1aa5a0ebf38291db5ce1d919836bc9bd0d4ec03ff
SHA256297bfa38cb893624a60d1a14fc0205ed64a524e3305621d1adb5fa1148d08ae1
SHA5129fdde5cae230f7c1d74c9bfa153407a52fd47bd65c30dc71bf183d5c9253187f1abe2ab5794b3d4658f2ce90a359a316e0ac971874a479b1e16299e75ac33599
-
Filesize
207KB
MD58c025966c65f064a679d4791bbeb6126
SHA1c3058b65aa9fbdfa2497fcadc0cb8041f6a5bbd6
SHA256e46fc5a5d802fa0932d82b954cbbb2ef03f48610da21b01068c08cd5b4bc3f00
SHA512f9a535238ee591d84b39cce59143ac0dfa9bac8ce6c5e91bda96c715f913796d86bbe25469200f3d010230378b8bbccae48a243b7fd3d04ed6abc6ee631ddf81
-
Filesize
1.1MB
MD5854bf8cfd031980e118fe933661f9c3d
SHA19cbe41d3e86198d1ad85828d81fe92b370b39153
SHA256ec0a7d3fd0f307c5ffbfffd6edef221858c881f664ec4f6a6d9a2d01ea164752
SHA5125c8f07e57683129c6d9392a86e12a99d1b65dda40f5a3661b6e385a276a84908f863a8d1afb9fef41847888015721f9e68ba83718efa6f05ce04bcd724cb2a68
-
Filesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
Filesize
186KB
MD5c9b43cc3bb9166755bc5d3b8512b354a
SHA1fb4829ce7937b0c537f686122631ad8b7973fff2
SHA256df5c0d846f43e6683924003341f2a94faf4f6ce58f36ea3d71793fea7c7b5eda
SHA512b8405d3b5e8652873694e6cca05044f86b5f6898275d8c877bbb7dee81f9798b4ea593c18b18b4f33e9a478d40893fe3fd8edd9e38c15644f5ac94481e89c12d
-
Filesize
194KB
MD51fe5e40151e2526f57dfaea0203bfaad
SHA174d986b375b246dd59c2953501c19bd4277d07e6
SHA25614cf558e156f5b06764dd0a9eb9df1d670e2812150418df49b10759c1e9e7bbd
SHA5124ea183c3b1c2908f0cf12f3eeedc6c5348c81582bda793e3e773865c62cf1632bb4c903c883ed25e4536f8513e2e50c80baf2338b4ec673f51946a4c2177c344
-
Filesize
187KB
MD57c02da4feac1843dfb573f82f5071aa4
SHA115094aaaa4b36df3c83c2c32c9c673185b0c531b
SHA2562dcd92b66bd4080b1ec35c208c3d1a9c8816e1c2106609fc2df7f80cf4a4e48f
SHA512958066c6d46aca6b588db9ec54f3a83a358a6b29518299cd14a2814e2a4c6206e853b5dfb81fb6be80cbf1199eeda87de0e819a7aa2f4bfa025742722675c0f7
-
Filesize
198KB
MD5aa9ffdc590b2f8c8bb24e75fcd86c8df
SHA11d2cf3a3020add0b4a91394eda1abd5e7e52bb48
SHA256613aa432bd066ccca49c1d38987fd0e9e7238c5edeef9e2bb5798837a50a9d02
SHA512d054b8bae2f53c9c8bfe86ced2d023a7ed421624a4e20098553672498d13015727d80755e81a9f9000c3641a34ceacf4305f9ebc9e7144f22d1e17d542bfd9db
-
Filesize
221KB
MD5e0b187742846bb2e081cd5b3876fbcf4
SHA1a4f572aa2555c3eaff0e58ff0ee0314cd397450e
SHA256dcd06192743cbd24bbab0c11280b53e8fbab94219ad038285190b9de762105f1
SHA512c4c62156436f2ab2c1b59a5b8446a9371b11fae213d1946d2caf2b40462d6f470a6eb0a690ecf98a5947375762949a70de146e07add2cd0e50a4f42b09f38d13
-
Filesize
631KB
MD5adce7425355854a3d45bebadb68c84dc
SHA18be57f40e978039c7db31766a96558f1e428566d
SHA256e9ba3e8f1157f9777d0d347e461d5daef6f4c0ce2864dbb2cede3888ffaa99ed
SHA5124c0a41bac6d38538fb4c576c1da5fea9494930620400c84ee4148ac093740f7591f03bacc1338ef81ba594efb1f7572890a9a081e245008fd5056f2ed93a6dae
-
Filesize
634KB
MD54670c5a0bc7e19293876867f1474cbfa
SHA18452f4c945730492fddca63fae479f45aa24512c
SHA256bc110025726354a0b73df9c50a9982ee4f87406014109c57752596210203b498
SHA5126519ae0411414989474641dd353b3f468503ca573dd9272f3f8d19a1e079861f8980da9af404685579724a35c211119abb7d0b5a07fedb518828b00a25e9f7e1
-
Filesize
196KB
MD5125c9cb7786f8b528c6c3d33f8e7104a
SHA144a09f73e9954364485eeba4e95a6cfa9dce400c
SHA256a652b59febae31915c43b8577f7afe0c59416dbba667f86408771dd553bf125f
SHA5126d9372562f1105bf040edffed8d2dedc9b20353674f9071bdefb220a8a8b9bac4fa08db849a7a1a37c2bace60ae7a88d7db4c192660e153bb247dcb90687833f
-
Filesize
2.1MB
MD596979d05988a9bc6c67b363912729ea3
SHA1284e0c551f62aa29b79b2add347ffb657d329edb
SHA256d5b264f4ff6eba95ec15edbd9e105d9a27975edcd9fa8a9afe34f65b93993811
SHA512597c8512cafdd0862b5c44606a6c5b5e8484be76776a8abed610d616ada85fb8bb3b481735a059ce96839b1b4ca2e4dd93f9c3e8233a669928cde218d50d63dd
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
197KB
MD589ced7fd77633ab456381060dcfa6e3f
SHA10f24a38cb442ddfd52e09f35186141448bc3b807
SHA25672d80cbc68b68ffef26ca77215d14e325f2bea8ab91688641e31a219370b6c79
SHA512e09f3a2efed2354483789635b1f865e73363922381dc54fc4b00301281f2e8db870b0986170bc68f2eb82912141fe079500239b71214f0e059bf5a17d171c572
-
Filesize
436KB
MD59a55db45129a1673799128432f6e64f8
SHA1fdf02d5ccb8b852fd44af020a45b0e602a336f0e
SHA2566edadc483aef744ebd355f5d63a557300efa8e0c42c231f2768142fb99cfeb93
SHA512bb1941a072865547eae69615e94c12aad05ecce425ad7c982104e52a0201f814b4aa39cd8dbb428fc874cb8c469f7353e956b879c54ca5d1d0f5194737b63f94
-
Filesize
228KB
MD5f10cf02148b29b0a251a67098c0946a9
SHA1d9490c88207f800de49ac4f718bb850a93c01f56
SHA2566b224163a76b03f399393bdb189320c16a8face3e72e9adb02aee471bdade9de
SHA512003ce9db3e6aba0dcc6a6812df6b2e647ef8923ca43b23d3c7fae71917a03e76f84249f6565bbc3c222a522cb259ff000eab8746c8e93b3e4b9ced5f45ac3fbd
-
Filesize
320KB
MD5c562bfbdf7ad382c7dbb09a37d8a4127
SHA179c91704ad37e125cd14f8e43f8f4f31f1d0a72f
SHA2561094e78248b18c92bda56ce6942b5fe66455cfc6e716e096e386626224e34d4b
SHA512f5a8d1f4baea9810af2de5f7eca5c4d9fd7212e3548a2d875ccf75b9d537121229a9e9aaf007e628c96ffe1dddbe8bced7545eb9ad4f94b69ef11756bfda4344
-
Filesize
200KB
MD5f30a177bb4ff1edc7463f04154b138b9
SHA1f2e2e3218c7421db7fbed3dbd90c483d650a9a4a
SHA25657d6cc5d4601a45cc51dda2a3b7a86b516a04f26545bce08ced8e0a7ba3e5c56
SHA5124d9ce51a8f0c944224ceaa18f4bd4b63fb64d749de4f85805626850bc26ae33805e5489554f2e34672f50277f0cf303219a1316a79d5f7c17f498b8b5d1cce22
-
Filesize
225KB
MD50730ee8b50ca25bcba256605cb7cd850
SHA1dabc7580648f748d68ea2714cd6f3eb9053816c2
SHA256cda5369995092ddec37dfa11a16847c7ea666cedd874f033f20e2ecbae05e10a
SHA51284ace2d8db4aa845ee13f558f860222497fa64693f482564e5280a500379663c4e0ef6cf254ed2f547ea10cdfd13c5bdcc1c8427b55a9a30789dabfbfe411a5d
-
Filesize
192KB
MD5208d5035fe42f77570a42533b93313ce
SHA13478ef072254df9c6bfd012811fb13362edec957
SHA2566a76b5642c08b03598741a1e4af75085eaf7344c48416eb73e383ed9a0d7d0f5
SHA512fd0438640e5dbb2bc2a28d8303bf70af8895e601ee882323d671c4f5ab55041262b24e14c1c51683e7ab6348a86cb43a6de309fcf95a49a665d28644578deb67
-
Filesize
204KB
MD56834cfa59c25464f881b471c9fd95dda
SHA1fef4ecd9b07cb75c66e84d80d65c8628590a3f09
SHA256ca3ab918d55c3ba286436325f7f63f0e4d83a13676cbf564bad3250300d8e5ca
SHA512ad1ad94d3b53d82943c4db9d30869d85189ff7dd2380575c9999d3795ca295e68b748d39b6eec7aaac6ebf49c66f6df8b5e6f1aea136c0a3b8cfd3b64bf2a0cd
-
Filesize
196KB
MD508e12d92bc69bc46f2bff542855ce6f4
SHA19407cc45861c5056f7fa5a3ae833cf0b9a8587d4
SHA2563df165fb1cd2c70f2e9119aea8bee939263d37d581063064ee27b98023961d24
SHA51254a90a057646dc4bc4ca3fc740bd89199d9d6ca6f1195453c534cf91bc75dc81706a67feaa9e924664371f6a39942fdd570f526933457f631deae243729af11d
-
Filesize
786KB
MD5d8116d9c430bd49b726f88f6fb21b9ba
SHA18d8665abe4343af1e734571f710185adf31b4082
SHA25647a408a42e9e4bf42668b2f1c8c2f51202cdc7dd6a894c4fb8aac3abcdcbbad7
SHA512227f313ec23925cddfbeb7c0dc5b1eea5a2f10194ee02e93ac18694f7d93e98c980e52c5f81089cb5455de339becd2bcea0accd6e85246259f4578bc73c6d51d
-
Filesize
183KB
MD586d2acd9fce2188550c45cb465510cb2
SHA11278b04ac26432a98aa044a76078a72f2192fa92
SHA25622bee444f89a53d9c941b9a47f70b4ae568fe1ada625bf1569a6fd3e3cf65b5f
SHA5129c7536184f8395d55474a4096aa9d70f57f3eb749530bb00126db3af4fcc2cb4b8809d28467b1843c514cf10dbf7700d14e85960850912ea85d5edb361d0b2b9
-
Filesize
322KB
MD533b74dcf0a232615ba4b1efee2d4608a
SHA15f1ea81a0af996b99de0a56c178ba94ca20f0a21
SHA2564e68111a0ffcccbc7aae84805400f496203c81086d98ac38664da548f8d51093
SHA512f25dc5da2c0af6e56cd3623a778f0d0c521895c00408e83f6f9f087418b665960f57fb85e33b754a4a043e9a559e905f2878dc5a3ee2024d69c63d7a7c3fc0f0
-
Filesize
318KB
MD52750484a4b0034ef8ce1b7f4310d005e
SHA1c26dccd4c87286d1086aee9f6fc8df61759346f2
SHA25660a468431b806242909aa17165ef4d7923d77742b39cfa4ce595b7b4ec8c5501
SHA512dcaca28099fd5edf9debcd74d1dc63a3a47afcd8100aed4f4c9fa915659b17eed087f4675c534ae23cacad009ee0f5b51ee8b612e9044b9833bfb78d5c39239f
-
Filesize
198KB
MD5eb845cab063e1de01366d23cccc05cb1
SHA1b8c1e619eb8105ef66d6bfe430cc9a638181e6e6
SHA256d30d656aa714f0d79e18503300ffc32cf68ec36dc0065442b228a5f8ee2f54c6
SHA5126b3505b4964ff722cdcf7ae1c74dbfc65c5d0c1842766a02a6acb815385f7170b67f9e92f6b667481b842ea3603ec09c20b40437c2aa664cfa113c6f19a0b0a3
-
Filesize
202KB
MD5b5ecc19f9ce21c5a41f9e2c2e40d8332
SHA174f80ff6a8df44b114d42778bb5829de49a891e4
SHA2569708e985834b0866ebf6afdc9cb55c3106088c8182f2eae4692e83b741926e67
SHA512a2bd8b563f2939100c73f9b2ed1c741a02c046c74c32e60e87e04b572eac9f7bc1cbd3996439dd83e7a98b812c3fe53801496d1102b76b96d12c49bb59b58208
-
Filesize
208KB
MD5f0d06c14070e311c518d1e1ca98994f5
SHA1a2c5b526a04f699acf63a068a8921d6cab38e431
SHA2569caf52686d0f3cafe942ff0b27863c2431849a1fc27a37c6051107165096d5f5
SHA512a8e5715e9632c47bdbf64d75f4ff3bd31c968d6264e3eb8c8017d03a4a4131204c9afb44c4fb2cafb67c37b82956fa027d3c053ba4ba0c61b6117b6a23dc2018
-
Filesize
252KB
MD5ad39d651f6e2087f43a32f7825857e1c
SHA12d9928175cfa360d8056ec152748bd12be6b4d2f
SHA25614aac29a72795d5c3cc9d5d06e047e72d18b21fee716c1f7aa73aa8cad9bce88
SHA5127d7c7085756ed840a5a167c1dab13541b5f6165655910c2aaa7354f69b26abc6e63566763f965d3686b2247fe571b7a45a7c14b95e8300af6919d51344082efd
-
Filesize
5.2MB
MD5387e96dcdf1a4607db74dd83df3f2a64
SHA137ee9ffcacf688ccd531f5325022625aafd71e93
SHA25622dbac0ec85d7b024ae33c59a82599271a265ed9a2e4e95fc1a8a14eb9eec75d
SHA512d322eb8542a0ad6348387676d7114796fd62c245df962b7ae603500c64ed642011974b5f169904e0ff56e9829e5507b67fae48b334e115680a26e1174de27ad1
-
Filesize
812KB
MD5930b566709bf31f7950227275b54ab12
SHA19c7147e687f0bd01938e2dad9b388ed24d15ff50
SHA2564ed0464714feb55f7826910af85556268cc52c7eed9ea0996a89d3119e907ccb
SHA51234e8885d71d29c3bcf9ddbf416a9867ce05bc6dc78959da0d8723780b1a97f46d00c556dad320909168d88906cc37218ed1285b2df476ab675e84a5e715e9792
-
Filesize
197KB
MD5f0c3e85474f829723604cd3a74690b89
SHA11185daacfdecdb74ab8c0eaade04b4d192eae185
SHA2567d21c10e40d2e4188ea30c3e88cb5b8463e7dc4ff5619e908af667ebfee25899
SHA512a1b64ca938be99c6cadbeb9a37c67e78e82eb77da1d74ff612e31cd94ed5168a2828d4144a16b4da52281b0562ce0750a5b359df5904d4f4d573954ff5da91b3
-
Filesize
570KB
MD547c52f5095ad1d892959b9012b4a2693
SHA15d6c07251db47dfc837c34b00d56d7485bb99e6b
SHA25616b4881e5d43ad4897457f31e37c0c96a867988f980cee2d16084e3632cd987a
SHA51213f099ec523a7b6af93fc6043b6d6c9b9239335d3f60ce9e09954108da2c6e3a397803ff77800990a4771fcd903a46d89de61540fd5026cca9c45b006378643d
-
Filesize
198KB
MD514bb81bc533bdc410ac829c32f394588
SHA1d70fd6d18fd928f05707b0215b83cb0fd0809a40
SHA256c43a74eb163c72ccabaa84dd88d025cd7e9ea985d63adbec03382e42002fcf88
SHA512b9b632ebf966cd607ee4abae958ba04f017f4b9de7689a06859833f93cd53becceda67e7e4a89da22b058ba0712ed8a8488f595e6ad52b18195744d3e7ef3c46
-
Filesize
533KB
MD5757689f845f4b8e1487568246060e40f
SHA1a95d511ec1416aa6b94fda40e2603f40a1cb94ef
SHA256ea8629512bba63f4b1f96445f07502656fb6b4aef2580fd8724609636ca97c72
SHA5122e2f8605797f05c5da48f690d4473939dae2df90ef589667597715035741f8cf447960a9b353319e0cd44dc1246531a8b7c7092c1afe57c8b97e48ca00f9cbe3
-
Filesize
798KB
MD5dd17f72ccdc4d6d32b8bb424fdbc04a8
SHA1dc9ed11d4225d6c6810428f37eba73d17a4298c6
SHA256d1c5d4c77e06769b5417da7b6c91f196b71151022ee49b2b0a4a2249ef471063
SHA5122dae324101ab3d794304a4648f55ee2397844778c9b9e5dd9df64ccf4c2727868fc42582abcfe175c4f8a7ff201630946c0b675c7cb1c5745bbe43f165620cd0
-
Filesize
198KB
MD599687f33e9ef8fd17cbb08645f29a98e
SHA193e4f60ba3a805212bc7bba26d07d5ab3a2f595f
SHA25684d8a0323668659be68d783cfd3daf128c059938e312e2f9281e551a19f0fc8c
SHA5124165475d36c29fe842ce618e44fa053cf4f7726755a8c1c23171e313edde1d255a903794c7ea1d7ef29122952ad9f89a996a152c2b80f24cd71f795125489ab9
-
Filesize
4KB
MD5f31b7f660ecbc5e170657187cedd7942
SHA142f5efe966968c2b1f92fadd7c85863956014fb4
SHA256684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
SHA51262787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
-
Filesize
205KB
MD53a5a3fcbf1f87c35a43b155560b5481d
SHA1edeb4527750d14df982c6363a33a8359b276c972
SHA256b26720eb36951ea752dd833a17663ee44d6a73fe8f7ea068374adfa09448b3a4
SHA51241940ade162ac94dcef8a8580d441ca35dcd1329168d94ecab3cce7e2375f95fc16de5c8de04e686e1ef6aa2240ddad51654c22b20b6a4a9a56f3794c41f29e9
-
Filesize
188KB
MD54d4b39217c02a4cf79e5d776086998c9
SHA12be810b59cdbe8f679ab400eb6067bfd508fa9a5
SHA25696018c48e182761d8f977065baa3091df7c381fde93537d130dd4d4caedcc61d
SHA51268a9b83d965de056f757a36bc35140512eaaf281a64eea90654633779365e5133a2fe9e99a23d00b47fcd3e8a153d540bd9c599dfed8d79644cb855fc9707b1c
-
Filesize
195KB
MD5e5337d53a78a5aedaa7bf7c3ef47c2db
SHA19c969cd773023fa3986bc2a7e9e7804258a36eac
SHA2567f89a43e31ba26242a92b407db6486b576b5c19535f83d02e0c24d60ebe19c08
SHA512500bff7fd152061869cb95b3b4e5cf520b0174847cc65b05a7c66986e151074620e096670ed6b813a1afa4b9d2e4e8c8938633962c3bfe3c8b595d6475d9cd05
-
Filesize
207KB
MD5df7820af6bfff0290921356fad2a4a3d
SHA181097405e0581db52db88eef3bea30c425533b22
SHA256869e2617e611b5b15e20d571e570f50b534b5d9b08bb5b373e50ed7c1c1612ab
SHA512345c64e9045090d91db7dbfc6c28a12fff94274c18c5fca1a7d6960a56315dd1b787e248eb6f15171188ea1c4aaa84148fb7b77bca5fd37a26d188c73debb7e1
-
Filesize
898KB
MD58594639d8eb8f250b4c0c28774409944
SHA1e1462b9b2fc36a7233c268821d6b73b3054c6452
SHA256b1f3a405c9a0a99ace297e1ae518b9de11837e33614c3c785de2b8fbfb6140cc
SHA512b52e369331d56c953710ce8471f398adbca76ebae5baca349b630b6086cfab789c4b7165017b12ce2a0df77d305a83a59c9340e4b093434fcb79415ce79c4f0e
-
Filesize
678KB
MD59ee160c68cd5743b551602c7c6bcec86
SHA1b76e12030f1195df713ebad4431313c02aed2d20
SHA256cce89854faea58b7644f7ac6e4fa7ff76976819943b7e8287fdbf4b336738c9c
SHA51232c524f37b21668598ce9d6d8b144ab7b85c141ec04cb2a4f068331e70b09292433b34b2f5dbc4b94524e342daafbbbdf299c46901dcda20d42d5927598640ab
-
Filesize
188KB
MD5f884189dbe8751d0b56a6bf5540d24b6
SHA17cc35b353c76386afd1fe9640116a01ce1718da6
SHA2564f00cfb9e67e75d495e91304b685387c57df1db3aec615cc6fb7607de89c3c20
SHA5122f19c853b592425d616854d72d0c009abd4f412fc67d909e4bc2e5715112fe4ee847c4b7c6b0d0934d2838e44d86bb8426da88ec00cf777ab0e5617f788b1262
-
Filesize
5.9MB
MD5ba64f97cc5c79c00800da51167025a31
SHA1f577a068cf8c5c94659425fb3e254d4019d05ac9
SHA2568fadce84927598ed8470f59c86dc25b669fc5c4c03dcaf2bf1d3634d9b6ff74c
SHA5129d08cc6e5757aabad8777c30dc0ae164b55f93b550314ce197eaf8d81e853a00a11b6ef3d3fa0d02e276468e0042d2a7d8b08b35d27ab74e06af693d56b27a01
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
184KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
192KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
