Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 08:00
General
-
Target
2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe
-
Size
112KB
-
MD5
d7b6e79357ff8169e09b0bb9957f2cb8
-
SHA1
388f60d0004f86147b9cfa0a7614e6a7d4aa7037
-
SHA256
e7ad178970d44d41da1858e77587156dddceb95301c6b33a59d7888d8aec2785
-
SHA512
1b7104a97e76c4fe097d59cc914a580c9f3f09f283d66b61f42df6b47384e7f39c6ea15f1c389c8b1548e0915f4ce9ceb46568c3455c52b39360b2740b7b6a51
-
SSDEEP
3072:RZ5z1+TdvOTOhY7YyqKYbLJmIBgdBC7CxzyQEOfPpzt+uUZ:R9gWTxcbKwB6jPXUZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Renames multiple (87) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\hqUsggkc\qoUMIkIc.exe"C:\Users\Admin\hqUsggkc\qoUMIkIc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\eosIQUMQ\PuUEIkAw.exe"C:\ProgramData\eosIQUMQ\PuUEIkAw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"136⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"162⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock"192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock193⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2194⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f194⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2192⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LIAIoEUY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs193⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2190⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f190⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fQogQQEw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs191⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2188⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pCUwkEcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs189⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2186⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f186⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LgwgYUAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs187⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2184⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f184⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgEsYkAY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs185⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1182⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2182⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f182⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KOYsQgIc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""182⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs183⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wogAMcQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""180⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs181⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2178⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f178⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TOEsQgwU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""178⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs179⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1176⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2176⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f176⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TuMUIoIE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""176⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs177⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2174⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f174⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqMAMkcE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs175⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1172⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f172⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGkwIkgw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""172⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs173⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1170⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f170⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EckwoUMg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""170⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs171⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2168⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f168⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGckYoQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs169⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f166⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZigoMMgg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""166⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1164⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2164⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f164⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pCQgUYMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""164⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f162⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUIoEAQA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""162⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FccEAcQo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""160⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs161⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2158⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f158⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YkIMUsYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""158⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f156⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckIIocwg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1154⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2154⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f154⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SaswggYM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1152⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2152⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f152⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCUQYAcc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""152⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2150⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f150⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NkgEYEwE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""150⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f148⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ByQgEEcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""148⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f146⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gwIcgEIo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2144⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f144⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyQkgoAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""144⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2142⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f142⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOMMAEkc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""142⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKgkUEoc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""140⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f138⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rQUIscYU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2136⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f136⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VqUogQQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""136⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs137⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2134⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XGYMMgsk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""134⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2132⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f132⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uUcUEUEo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""132⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs133⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2130⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f130⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgwQAwgA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""130⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1128⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f128⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qcMscMAk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""128⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f126⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YeMkYkoo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""126⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs127⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2124⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f124⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zuUQgAsE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""124⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs125⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f122⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZMsQAgsI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""122⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f120⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkQMocAk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""120⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs121⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AUEEQYgk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""118⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kagIAUgY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""116⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IWwAoAUU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bMgAogcI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rScYsQMs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqoQAQMc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""108⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CUkEwUAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mskAkcgk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OAYMUQIU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PSkUQMcI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""100⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JykoUYYM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwoQEcAA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fkEQAsYU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eegoYgkA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UWswYQkA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qcwkUQAg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VsoYIIEc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKYQoAEw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RQcUAQcU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VQUEEwks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gcAsQMoE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""78⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GAkkMMQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OIgQokYE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NGQQosAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zKUYMccI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgMUsMAA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fuEIQcos.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GoUkYQIE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMAMoEoA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\giEEgMgw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwgEgsUA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\biYwYMEo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vEAkUMMI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgwoUAcE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\imQEIUAI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oIMsMQIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jasAcUwU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rMAMAscQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zCkQsoMc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYgEsQkY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qKsgIcwg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwwgoEkk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQscksko.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xyAsccAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BaYQAIYw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWIUsIso.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwkswYgU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ekIgQkAw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGIEcEcA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSoMUooo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mqQgwcos.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BakQwogI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NCIsEIkA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQEsUMos.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nEwAMQIg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwoIskMs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUwQQYUg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mqMcMQUE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmAUwIII.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv +oeFwBTIGU+ql7A7drCLbQ.0.21⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exeFilesize
154KB
MD5a9ea015db4c8732584e6abd77767365b
SHA1aeb90bdc6cb9a28acf5b830316de5c37bcef135a
SHA256694028f51005288307451fb49b82785190cdbf7272c01c086064ffc3dcbaa62a
SHA5128aea98240eb344bcdfebc195393d769f6980e7cd3320ce4d1a66b71830b91260d0fc1da90c0e6a28c686d20fd17c6b6577323ea4e63f4cc61ef7d2281d6c6865
-
C:\ProgramData\eosIQUMQ\PuUEIkAw.exeFilesize
110KB
MD51cbc46b7df0cc04c733061ed47cd4869
SHA14cabdcf224999be95783dbba238ef5ab68c86c25
SHA25632bd707ef28a62cf2fadeec77c011ca0067396049f65ea3c845a966c421aff62
SHA512fd4f180b3e969eb097c0a4a509a85509ad50dfa6d61b87314488825b6ab973aa46b9fccf81108b567a02d7e6b4d8bbfe050d4c888dde0eaca92168f7e7cc930e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.exeFilesize
111KB
MD53856972e56ec61f4543de5ad51b39110
SHA183712a1b8e236a37129aced28c30b0448d0d60ec
SHA2569d7ecce68174273e7ce14a4d3846fefce7a8620e38a675f1a34b66e827c6816c
SHA51294e4545af5b497c56496bca3a53fa870d13ef2c7010cce4e9cb646ce0b5282007cf14ca4abe08151bf3c2369225528d2cd073bd338628da1385cc87434690c1a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.exeFilesize
111KB
MD5e25df21c94175ce19a6dbb4ae1e68763
SHA15546d0c3f3e68d8ee97240caf634aba6dae7e222
SHA256a5f71e774d4d763a581d48c7751dfc3a1391b81a4fc1f2a99f5fff3006b09732
SHA5125f118b41ff2349cac8dd28c0496037dd0e5dfe013b60e520cf03c4a40dff4926f6604ffacdecd3b21070ec0912b66db5c447815efa526ece8c50c8849c921f41
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.exeFilesize
112KB
MD54359f3f7ee08721b474b4ad5abf43618
SHA1d113c51e1a33e1b36a4c177bbd5ae5e2079ba7ec
SHA2564c48a582d897df83d0884dd75c2903126463899b234a24374374e92b6ac6862b
SHA512f20c0336bb3624b13aa2c4a1225f74d5d8d2bd1bfecff69e529180a21d20ecd6e84967df4870cf9d7cb7c63eac1633e61ef4a481c3eb20f5a0eff17d4a368d9d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.exeFilesize
111KB
MD5ad4badf6a4b4e806a9cdb65f452822b4
SHA1ebdd7b1300e799a6374b157e45c2c944d09cfff2
SHA256b9e86f65c615d25a52dbb0545bc6bf5caa362d33f94e81fd79586c72d75d2cab
SHA5120e119607f58ebb59ade5ed3d8041c0f229bafb24e897aed77902e3fe224766933f6f64045c69e821923955ed7365bbf6d30603526e8693b3795657555e6364a9
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_d7b6e79357ff8169e09b0bb9957f2cb8_virlockFilesize
814B
MD582fcea1a20250c6943e1542f233bf848
SHA1c4b4be0882d43c9c9f516588177d10703112516b
SHA2562d0a2fc18aec63afcc8b579b23ade273a2394b9875c35367690b6a293dcd7e6d
SHA512fd4e160543ce50343be7d1ffe26c8b4d841eccea985f4e142091e1cdd72a724d6d84071a62cc4a3dbae6eb51924ef9f0631a09f4a15efaf4e79d21f3c0f8fd64
-
C:\Users\Admin\AppData\Local\Temp\AEAQ.exeFilesize
111KB
MD55baf6e28a222df14c6a5cf9a73a2592b
SHA1dc1c0a6505de763d30c6c340d476209ea5e25d23
SHA2567b0be83d774630bfb178400eba999ad524f7efab5eb52a63b1ec784a5410740b
SHA512c7b37f0fe3b64aefb05df264c88fbc6f299a281fac98003f093906bb1a749be81455ed4911b334e5451033a6130eb372c3b3ee31627043babc8e9721367cfac5
-
C:\Users\Admin\AppData\Local\Temp\AIoc.exeFilesize
670KB
MD55db15b03e7a50622b25708cca3569903
SHA12f05006de3f586e456e48ce38350e430d9b414f0
SHA25659ff34f3e2d7d34a78e55fafbda99d468148cbfcd71feb41b8d695a4c087400c
SHA512ada18ee7caa3730b1abc01464ebf0da83845d1552a7ddf475bd3fa081a21dd1b2b56c28d8e425c87446f20961c72234e9ba256c4ac559cfd8415f4c9b87e36fd
-
C:\Users\Admin\AppData\Local\Temp\AMQU.exeFilesize
113KB
MD5a0f00ba1ffe5d50b880b9086f1783afe
SHA153cd0ba38c688ba065424c71075ad36fd98a924d
SHA256ad8eea1236805967a0dfcb8f15618407f9ce386a4e6ce8a7e4e88e7ae6ff53c1
SHA512f898511496564035783e18f3642f21b4a5196f2e42991a21e18ddb30b49964a2d9d47135a967816c6b178fdf773fc24557ccf09d4d454e6a11c5d936788ce28f
-
C:\Users\Admin\AppData\Local\Temp\AYYS.exeFilesize
556KB
MD553d00eb44767865bd59d36c58591ebab
SHA1bf0f4f61c61ccdbeef290ee0438fdce69061efe1
SHA256ad54c3b611ecbcca2506b56efa65e33ee42b1762eea965766929357a8f2666cd
SHA51292a75d0648d94602f6a8196821564f8b96ea1acf3ec4080a471e7148723de8744e63123c3b2b47876eb91b30d3e0d520ad9ee7b62fbbc983f774a4dd84a09e40
-
C:\Users\Admin\AppData\Local\Temp\AgIq.exeFilesize
302KB
MD5be53fdc20cc045c00859bc169681efc7
SHA1f34ce23fad93259adb75c8c8b0c98520da4f30cb
SHA256229e0afdd0dd46cebd9558a32f516f5bdfe30a1e97f368785bd8607f0a9b079f
SHA5120ee6256da1d74ea56c69fa1b3cbd2af933759896112663335070607a0ef97bc23c8ddcd5e7f3ca29c9e5f0f8f6bc529e0e8a8679075388e21bb2d98e7fcb7171
-
C:\Users\Admin\AppData\Local\Temp\AgQK.exeFilesize
115KB
MD5e8884659228855c8dbeb870213866651
SHA19bd706850e2c11e9f8dac434f4389e6f8240d450
SHA2568aa4642c63a6f3ffbc69f1be7b894c31697327d0a34f9c73f9fb1c52bf810933
SHA512fa9b1ad3e042183d8cd2ef91faa03017e6cb227aa5290e0fcd1ba02119776b516cf0dee648f26c28a4f7e8411ead9b54b44a78c34d009f41faa6f7d06c0555f4
-
C:\Users\Admin\AppData\Local\Temp\Akwk.exeFilesize
564KB
MD5cd65503aa1d29ead42b44cd00b4ba24e
SHA1c0b346e87fe71ab19709ddca9c894a4e1435f7b3
SHA256c5055a637134b2bdf55cc5955f060fd27c7e774e92a47b09e810966c70f9a463
SHA5120bcdee9ba0ac1ecbc6335937377aa3b3d092ba5a110072d2c5f9762a2b4c2d775acdaf525c2047b429a825f8da9ee1cf2fd82a0d8fba38577b3525874056016f
-
C:\Users\Admin\AppData\Local\Temp\CgQM.exeFilesize
112KB
MD51781e41c9ba76e1f727960f677ee93b8
SHA10ba752ed56058087cdc452a9bebaddf6a625676e
SHA256fe8e889a03987a7f246519c34a37f89e6071a945a49ec1cda36539fd13150456
SHA512afaf620e4a39cdd908d60c8c07b509fbd56137282834f0e5e96ad18fc288c0f0b88c65dcaccf15e48784d533b59e401462389cb88f45ca014db350c7ea1a597c
-
C:\Users\Admin\AppData\Local\Temp\CosM.exeFilesize
112KB
MD5af878e25a249b1b0f42781d5e65c2580
SHA13c7a43c67f17c7b3d70c5017c9f67b5ecaffea51
SHA2564c9cc750b05ca36b785b6680f898ec5d7957d501b0c9013c49ef2217dc350955
SHA51256ea738d36e5524db62f2bdb8019ac5135c2c46919a3c78aded5af455fb1d6a6ae446451ce5b2562341586a5147a8525a5bd9982284c18ef9b777850d0504566
-
C:\Users\Admin\AppData\Local\Temp\CsAK.exeFilesize
377KB
MD5e1b897c0d5ba399b39ae4d68ad6f538c
SHA168a98f2155a4fbd104c28a89f304858b41595414
SHA2561badc672ea8d5e3cc9057fd85549aef2b903ece1a3d5df8392805de4db7c8f2e
SHA51251d3030c11f360aa1de87c4a9d24637b02f24590f973830d051a83c3832bebde1a05e234e1c88cbb9affc0c425420053822c013b695578fc51ba41955f9b6147
-
C:\Users\Admin\AppData\Local\Temp\CsES.exeFilesize
119KB
MD5a700a070674d80a49e056124e84d86a9
SHA16281206ef5a2a1106eeefc3ba39a04602d679840
SHA2560f01e87c1c070d5acf5038767f36e3e8ffc2d8fb471672d981c4a28b8077f0dd
SHA512efb9f2cc96f62700282f0d8b9c45fb1d8b6fa3b3d78729c180f1a813cc23f7a69ed8c496f2259882651a0268687ece1c95f753ec3471ddc4d93ba65d27d4df17
-
C:\Users\Admin\AppData\Local\Temp\EQgg.exeFilesize
110KB
MD55a35b21ac67922d57f68c3d46b4d4c57
SHA111b6eb69afdc1b492a876c83cc6cc646c63f414b
SHA25601bc3b6a8a2e19adb8b0e086946869b059b69c3fb7789306753c78abad295f94
SHA51225f38444fb450d5c4379f52151c47fcb0eb5e609329de0910386ec09bb0d05320f8754a99e83a2e3e11824f11b88f85880d15979843b73b3c2d2974ef66fd559
-
C:\Users\Admin\AppData\Local\Temp\EYQg.exeFilesize
724KB
MD5952d9695ba3e186d47f75f4894e59bb9
SHA1ea6dc6d1e3153768b9f42a1fc2b585c4d1b86a75
SHA25669c5b5a9231a2c46063b24e1243a35ab6d266388b634bc7361346a316584f6da
SHA5122d8bfa185a352b07942a8da9132fc6449efc5a7bc3bf0baf73fbf38d19513791620716171c6e8a149c0eeece66ed6292fb8f563fd838e5edf5fbd6289a6a72ba
-
C:\Users\Admin\AppData\Local\Temp\EkQm.exeFilesize
110KB
MD51f24672dccea187ae34fa868bc9a8d3c
SHA11e7f22c1fa2d703fce30e3a353ccf3fcd6c76e63
SHA2560e48bda5cd0ccc480223dcc24b18221b0a152a6e31e4a1b4822e996a61b03efa
SHA5127d60265e27d49998bb24d072fd23c60d8932129da5cf4c8c75d85cb1d0e92212556be1d3de7a20dd64eb4f07b68025e7b5a2de1a3ee9091fc514c9841729f981
-
C:\Users\Admin\AppData\Local\Temp\Eksg.exeFilesize
120KB
MD5424e7edc1627aea040d1390b1c544a83
SHA187e2a31746c5581323222c61d64c7c60334ff9a2
SHA256be13393e619a2fa94b6b504d2e72fb1b77d7fe1e5b8aa54409ec5c888d63e5c3
SHA512cfb7f0d64833875a21acdd043ae969ab4f3e024037e32f84a62d089b4ee328713ade7d20d809cf26c14e1835f612bbb7e85bd9147979a4ef1e9cb9f276fbc331
-
C:\Users\Admin\AppData\Local\Temp\GAwu.exeFilesize
113KB
MD5157b4f51b63d63b7e7b34f4a70260f7c
SHA132fa12e7d47a91893fa67e3b5b933511af12a0d3
SHA256e3f19d816aaea9a08fd5e583b13e3b7a6e7b0b1713c42dc4c5f27b55b0db81fe
SHA512697762139e61c701774667970cca459fad0052b547e22b0c1f04c84de1cd21c298550f5880b4268635602b4e1978fdf66b7d2b6776fb68de04730dfe6c54fec4
-
C:\Users\Admin\AppData\Local\Temp\GIMg.exeFilesize
122KB
MD5cfa21568ce148f211bbfd88dddd0db65
SHA192d8b0554d0f4e528fede32bee200d8ff4827fbe
SHA256ab3d101385c9d7f747c505be6b411e6f6a10566a9a4bba50991a8ab857c90235
SHA512dbce12ed90df31cb6b7e827e688a9c6b76f8ea1e2a41388449074f60865af4b5c00c34591769d2c4e8a0b7a1de9c09ca7019e6567bbe6fe8a9fda2888423660a
-
C:\Users\Admin\AppData\Local\Temp\GYoW.exeFilesize
111KB
MD537f2018516d496039e19c3f5fd7971c6
SHA160763b27fec850933aa9bcef57f727ee4e121332
SHA256eeb34fa0305cc644f5bc43b6c90b8803bb4dc92e19cf4344cf10a6c1db59e321
SHA5121fcf555e40e2bc717de83e84255b821ab84cd7f786e858914383b71dbe64268f3c169ac568b3e99ce1f20c161bbd2cb2345d75c578d0976bcb783fb1160b1d0e
-
C:\Users\Admin\AppData\Local\Temp\Gooc.exeFilesize
1.1MB
MD5de6abad1e09da5f1904eecf3b93e53d5
SHA150f8ae2709f54c0719054a3437bcbc5aad433a8d
SHA256e270dc631884468635e7a114e30d9c6a62c7de906f72592537232f7a95b928d2
SHA5124662194032086e641b3f231ef752596c5ef0db55d6b077f4f87bc8c24a1c1a0a21edceb30a2eb818488f2a3520137f48c37eadbf2f7d59607a58de15f7e35ed3
-
C:\Users\Admin\AppData\Local\Temp\IEYY.exeFilesize
634KB
MD567bb5aee4ff74e020e70a9e17503288a
SHA193c75a5cef52226c94499fa8c0cd82bae04e1f3a
SHA256d010f75a8c43b0abfa348b99dd6bb4f346b73738988e0963bb8b35ba7f3b9ba5
SHA5121e48436a0a4e564f9e6e592c241f7b906f6353a899e783f12d1bde0936387080be1eb882c008b66a0d284d01f78e5c9b3d327a2c5b5d7e44c31bf52bd7104a8c
-
C:\Users\Admin\AppData\Local\Temp\Iggg.exeFilesize
532KB
MD5792831db88a5f92314b81b7091e756e9
SHA1af05d37a22d220fb3e2aeddcbe997ac37ec2c758
SHA2560cb2667569567bfd3abfe6ad254691a7c698dbc5d0b1cc59e72d1c43c0c8c508
SHA5121b61825ccf51a8349ad89577a97f75c9e1faa472fbd62aeca0f1d72fe507864ff51d4b73dde89d2c43ac05fd695791239270de5e1a57094c99ea1c7336e780fc
-
C:\Users\Admin\AppData\Local\Temp\Kscm.exeFilesize
111KB
MD53f7dd48523975274cc76a27758cf39c9
SHA1fec0eef3a5acfc0bc6c97de1ca94cfab9abf67fa
SHA256efc0bdbc65ad3a4c4682d94d8820bbff143c3273299ed04d304b7519498856c9
SHA51265a9bfd0de5d469636cc0bb227bdd599298fb0fe237e08de86a6a7fb84643315ce17de6c438f76fc7c311f9941914be842dc89402d44e033c5056c2a508387ff
-
C:\Users\Admin\AppData\Local\Temp\MAMG.exeFilesize
493KB
MD515084b6cb6a5d68e028729608ba4adaa
SHA1c9583d6f0fef975b8775a3af30be9c7f8bd29a6c
SHA2569d752ec60e3c8f500188bbf92568bf9a6361dba70c90ae65e36cca7fc29b728f
SHA51212b55e5c423bd2feba393c657543902bc547ea578156827d4addd3ee2935d36d1feb69e85805ea1a810938d016e2a6d057905c9b1feb40ad20221d2005e889f6
-
C:\Users\Admin\AppData\Local\Temp\MMQi.exeFilesize
112KB
MD5fa8ef28e127bf4add1b1eb03b85a09a5
SHA11a8253456e5e3eab427b3f287e80e8fc98c73b48
SHA2561f3c0e59f6bed4bb562ae8ebb2b7efe060125e4049c8b52f0956c30934b7575c
SHA512a75caa6e6163531d9630b44c17d397fc3f01b535a53187d6891e956077689d24a12a4b1820a1f42f5bc451e4041422f345d17762f3f51c35d965f122a27fefab
-
C:\Users\Admin\AppData\Local\Temp\MUAK.exeFilesize
118KB
MD50204f417cd4b5a4cdf7f520bd00ef887
SHA1ce054ac0f3a541e6819cf6141de9f381a82815eb
SHA25639554e9df55048be45a394a0b14d255b20f23e3801948146ef2dca5386c37ce9
SHA512ae6ce3199d1fef0fef605f73e114ae858892504f2128d094ee0c77e66505af92d59dc5369f159c04822375eb76fd61a4d5cd437b967658f83e642fd881db14a7
-
C:\Users\Admin\AppData\Local\Temp\MUUo.exeFilesize
139KB
MD5c8cf9d70e56e4dbfb6bb82cdf8c3aedd
SHA15310ccbc061e96e0390634a0e4aee262540612e2
SHA256977fbcb87dc2da991df3562dd00a473aa526e466e50fd22f14f1a58805522e4d
SHA51226ac1ea5f2614b57631f0905cc8a445a7f5e3952526a612e527f668f23b2a6aec11a2b7717e3b68c21afe30133cdc0f53063468e9acc7124bf29b69f4f21f56f
-
C:\Users\Admin\AppData\Local\Temp\MYIA.exeFilesize
120KB
MD5b5b3aa7b33a80b7b21356f8605965373
SHA12cf003c4bdbf2b343a727732b0bfadee92f2d105
SHA256854de112981c153c851b256318e95b6737347fe819b756a5b492de9a461f02f0
SHA51256b427036504ce7942085158144dd053f1a8358c8a8e4be817430834e8b88d2d91b1570c58a5523fcd2ca7dcc3f54c044d8263c649b6b5a69d2018e3ceee9b11
-
C:\Users\Admin\AppData\Local\Temp\MkEA.exeFilesize
619KB
MD5aee0a9d6ee5c28989fccfc06ac1177a4
SHA11b614525b3fa8d22319caf1ff80ece78956a333f
SHA25636ce7b7d993841ff46900dd01d9d1fa1d8a12ac906373c8aeb7bf7a90b490a8b
SHA5128ab8d775a722e6858c394174e6756fd1cd07ae573e6489d1234f5f4985fd0400932d6cfe722dd9ab154c9d9a2283652af94f7144a903326f6afd6e767b8b3e19
-
C:\Users\Admin\AppData\Local\Temp\MsgK.exeFilesize
119KB
MD52104ae5447ab7a11f0c5521e09df5c3e
SHA1a3ea80847e3552caea5f5a76da3b70fe0ddd80e8
SHA256dc22158c633af9d7f0c3df4c8a7656ba650a901e64ac4b40276c2a8ab0ceb9a4
SHA512d7ed7b489c677ae032ede30bdbb31df6c7db1bbd4e4ff03de1899c6bee841a181b1cac003e49821f1c2fb06463a4d2cb0747d2f3ab9bc33daf831268dbea9869
-
C:\Users\Admin\AppData\Local\Temp\Msgo.exeFilesize
697KB
MD5393c5d9660a6342cc7bcd9dc6d65465c
SHA1e93de8166e2a7b6f791d7720db934bc5d1f616f9
SHA2563d9b02e2e9dca81bbfc2fbfb2f2a70bb58df3c556fa11fca31a2b1c7097e2e4e
SHA5120d62fdf79672c712a3c856d9be9ae2a93abf8433bbf54a3982135f149c7a2cbf85c7ec53fb5cafe226a9daf09637d2188cc7d6a77b37cd7bef96799cdb873faf
-
C:\Users\Admin\AppData\Local\Temp\OQwI.exeFilesize
721KB
MD57c037f6fa40abf0d4420ab1126080992
SHA11f9a3073d443b1cde8b5ff4983d0367e5a0d9e94
SHA256d20df2edb201c2f8ae409596acb4ec7ea23d129f93f970a6dbda2e56ace5ea0b
SHA512676581d669dcef1b5c05a9e720ce04ab2c2a35aeac6ff10b1eaa30871db534854de23fb68973358553d19b689100cd3bbed2dee7889c7ac2de03a493f50a69d0
-
C:\Users\Admin\AppData\Local\Temp\OcMQ.exeFilesize
116KB
MD51330217a0ead896dec736f15057bd037
SHA125026f5423657799fb49f2c86b4ed68f6e897971
SHA256c958172f8322307490a5e0734316561a930ce22532f8b900ac4b087f43aff6ad
SHA5125ebe4b788f320b54995d47d8822ea3fcc5df54f246470c618af5d8ae7644d00b80db745b07ecf53cf9d323937e61473454077689247a95d21f3d26dbf7313633
-
C:\Users\Admin\AppData\Local\Temp\QMYE.exeFilesize
117KB
MD57c8380223fa3e49e0fb0cf244e8b05aa
SHA135304a54d5d3b944015adf93eeee305768873abe
SHA2567dba8e583fbe48d2e5dd9b0c6034930f0b07fb272ca05de22a10d2f5464dd50a
SHA512184326195c1490da04016ef7e4ccad1af09437e0d300e84bb71a673e79421fbffae946bb372288b67696fd219c5ec71d83c56ad661d2acd4dd0232b3dc75378f
-
C:\Users\Admin\AppData\Local\Temp\QYIA.exeFilesize
110KB
MD5f522816641f21b6b11e28ac6a30a8188
SHA16e93622350b20364ca22686d9e33b533170340ed
SHA2562164dba7f191f7e53fa6e216b018e6f851c106204b7cab3640507a1336f100b7
SHA512c8abd764667797d2e6662f5abd0448095ea517d10616062497dad8ce771714479a6d2ab2dba5f2f1458caf55f4050ed353a012fcb9113a013b7ece60f2f28c4c
-
C:\Users\Admin\AppData\Local\Temp\QYME.exeFilesize
113KB
MD541f1bd49cc4f911263edb1d6505ea7cb
SHA126559d40bc635aea32a45c0680382ab47696574c
SHA256952d30c00fc3668fcc413c4c90b4be0d48c1599662621637378f627e1ade941b
SHA512bab5be61330a107bf779abaa730f67c5c94dce204da4e9404f6a7ebb4f355719457d637dab47a7ae43893cf52ac3f24b697e0c6434a5b9861f290f08e396a798
-
C:\Users\Admin\AppData\Local\Temp\QgMk.exeFilesize
143KB
MD55147035ab29450b2150b7ef3d42e3cf1
SHA1ca6af3576cd6e25b20f618b5b7d6bfbddb42b87e
SHA256c384924d6ee2ce3aacae87cff2a950f26e4ad0f74f6ee680d8dc6969cd7c0ea7
SHA51247723b857809cc91523b6e66f5a14c7258cb259449296a92be6b0a025f2af8edfac260fc9725ddb3b7b1019b3d1f5e1192d393ac6dc367269579d8361816fe53
-
C:\Users\Admin\AppData\Local\Temp\QkAQ.icoFilesize
4KB
MD5f31b7f660ecbc5e170657187cedd7942
SHA142f5efe966968c2b1f92fadd7c85863956014fb4
SHA256684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
SHA51262787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
-
C:\Users\Admin\AppData\Local\Temp\QocC.exeFilesize
345KB
MD57e9c3e691479409323f9d02373e613fc
SHA1fb51dde0074c29e3aab7522a691ecd0a9bee619d
SHA256df9c6faca8e1dd08a9aecb404046d0deef1c7783c6aad80acb9a70bd628887a9
SHA5121d3d7c0e11fd8d201faf62543a355b4cd34592d83e68f77c501757534bbeecdf9142ee0ea694501d9fc436549f0c3284d76a0fc4268d8fce1016b5c026947a59
-
C:\Users\Admin\AppData\Local\Temp\Qwge.exeFilesize
352KB
MD564377f37944c80c9ceae9052b9a98677
SHA1a59570a311da865af56b59e87a4efe06b7730c51
SHA2569ddcf0b5b6f965a33236b89d22c67670778896c68a22bb686501e29f92788b98
SHA51225ff0ff19e6752cf6adbc6f3cce29509ef62465cf39cc401422e542c4c32411d8f54e71f87ef9c09349a83f452d0f4dedbae3e9c01b013549de9434e042b29eb
-
C:\Users\Admin\AppData\Local\Temp\Qwwq.exeFilesize
116KB
MD56e0d3310490e42bae123d6355492ae61
SHA14138c92d7d6b743e28421acaf2f98f8841646f90
SHA2564777dc44d23fc275105ab05e76893f75c4e287a67f0c3eeacf47bf0c4a08134e
SHA5122e7f440b20af5b5ecfae52743030e7fd0f40f5805a08df709b3232c4ed1b3c10cca4449f55b3aa0dd4a4559d2a7daeb6f0f31dff28b574c8f2d7d185be8b4c02
-
C:\Users\Admin\AppData\Local\Temp\SIcw.exeFilesize
111KB
MD5d369288a442497e8469144e306c80ccf
SHA10c8528c247915479c43435d0c4fdd294198db052
SHA256b24ac7adea1fab660ca2f57647740978b62eb41ecc173a924d39ae4362a14029
SHA512a3cfd2d5d9b685af69e3492282c1874bbf5bdeda1028e217f56fafdc3faf8d873a21d09f0326c754f457e896294628d1b9f421225cf5b5f46e548610a9e5eacb
-
C:\Users\Admin\AppData\Local\Temp\SUEi.exeFilesize
236KB
MD581b3934093a1af06eb4ffa9e87f17cf1
SHA1a37a5e7121056b07a5979dd1e002aa422fc164c0
SHA25656e343ad257789a160de5ef57763abb2cee485a474f453e460de16550a5d9951
SHA51290b0831077995626d3fc670aa628bdf832fdb082729e20ec8ddfac3f6ce6287c2506d6d5d8d54292b52728d9eb929ca88b1caab6928cd1d6cadc151abec9b3d7
-
C:\Users\Admin\AppData\Local\Temp\ScgW.exeFilesize
112KB
MD5415f7a4164383e0d5a72f6f0507c7c7c
SHA1d95ae1ee81f3b3f61027b001946ea2933ea256e1
SHA2565c22c40e5c3a8d2d4626a6d50fdd46e8e4b9747cb0feb466369d98d3c90dd12d
SHA512a0d5d3fb73433a8b304ff21ec299c9b5b79818285a5ea446245a0674b050da194496eeb9f569b5b9b82dee14ddb0e0f1472ba0523a55e36cb03547c513740b13
-
C:\Users\Admin\AppData\Local\Temp\SoEs.exeFilesize
111KB
MD579825ad9c35ad58981e8c6bbcfe59851
SHA175cb9df632c584b4772afcb174beb9214b59a0c5
SHA256c50f8f0c3aabdd1800bb9f1289e9106a1825a2f136d1e091044b20bb09dc854a
SHA5123d1face4c182c2417f0e54ff29efe526b1e4bc1eadb7929e580d268ed0d1b0476ad0483bb985735d1e903b6e830cd1594323298b721718ff79bead7b0f67595a
-
C:\Users\Admin\AppData\Local\Temp\SoMm.exeFilesize
116KB
MD570438c94f5dc819f54a3e75e74eff0d2
SHA14ee8a1bcfec60b39c15fd360431be43c5d90ef4c
SHA2568a87abead8a63e92e3d8978c0855ee86168cadfb04d974e7c4a078a725b05a33
SHA512ef6cd30ca03b1366f483b9f2d79d8e53d3fbc65575e254f63de3c80989abb906aef75b1ccfa94781c80534d81a8b820b82b9f9e011f452334ac9098e7d410ed5
-
C:\Users\Admin\AppData\Local\Temp\SsoC.exeFilesize
566KB
MD5773035ed7d734536f82c78dd7fbedf45
SHA1b18476b9f3386f2e21b874f62cc76e80d900d772
SHA2569288ee03c9f54896b1ba79c4b6dce718b80daea8e017198e25563b202ac80f6a
SHA5124784d6419515f86cadb9d66f27f2c1723c9e6d8965cb7886f96afcb311787b8ec4dfd0f74045c918ec6fe7befd7f334a3579b645430d47dfea56f9fc8fb9011c
-
C:\Users\Admin\AppData\Local\Temp\UAkC.exeFilesize
111KB
MD51be2a9b641d0d366f8d1014d124cecbb
SHA146e0a47c4b7d611ca89c1f908c6291d1003af7ed
SHA256e733a90198b719f23015af970c163b0f7515d0cba7570aaa9beb2cb9cabea382
SHA512effe40d05c9183e26ea171aa9bbb019a502a63ff07b41380cdc2df3da673e712f2758f252c701cfbc3f3c908053fbb39065dc9b10719468128731d43cfa5e35e
-
C:\Users\Admin\AppData\Local\Temp\UEYo.exeFilesize
111KB
MD5543eeb83396ea524abf6a6040a9ed475
SHA1afdbf634c47394a333ed76bc627db5a1e98329b8
SHA256012637f060afb7fca4ea2881e0ae4817d86a2ddeb841559b4dcfc17d4916db05
SHA512f8cfbb1224d031bde5feae6b01efad44248e9943aeadcc61893f3725692b67de3fa55cbe5861e116259492423f1b97705bc2e112a40eec12b735648810e6ca12
-
C:\Users\Admin\AppData\Local\Temp\UIki.exeFilesize
112KB
MD526673d938aad13cdc07acc9f446cfdba
SHA1411f44a3ad98996fc8d091425b4997bf9a506869
SHA2564244084c932393654a9a4e37db0fb330208e39d9cb81b0642829d9b061adf427
SHA5123cd608d5368d9e4e42930e94e35aab8ad222d3a10574ffc1c89396c841dc72806ef8a1fc70fdc5d9eab67bb9cb091b6f91ddeeca592058242c9cf51463930203
-
C:\Users\Admin\AppData\Local\Temp\UMIM.exeFilesize
113KB
MD5885782fbf155aa31d6d3092c3f2300fe
SHA1bfda143b522ac40c1145df1427a2719d285945c5
SHA256b4c28ddb93e8f85d92cd897e0185d6e339b8e8a6243db54dd6edc26a026e9244
SHA512acceedad9e8ad1b4c43f62a28caa09c062025ec3c6a98a167edba91c0c2afff5cc615cd155c5e432c92a23ba546c3c6ab7df2e5082f400ff26d21704f216f786
-
C:\Users\Admin\AppData\Local\Temp\UkAo.exeFilesize
561KB
MD5db94d764ac7d801a08c32242b8b21b82
SHA1921415b6dc11b55365418ef17611a554b58781d2
SHA2568a048d0156248971a9d1e97dfcf2ea3536e845d0ac56c9551a6b11a6df639ab8
SHA512f1da25098783ca8fee0f13d764915b740868d04e05c2adc0376a890875b9413f93b64a321f461333e86e16c1e0f877b9f4ba77ab84c97a00d756f6f4bbed1a2d
-
C:\Users\Admin\AppData\Local\Temp\UkUY.icoFilesize
4KB
MD56edd371bd7a23ec01c6a00d53f8723d1
SHA17b649ce267a19686d2d07a6c3ee2ca852a549ee6
SHA2560b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
SHA51265ccc2a9bdb09cac3293ea8ef68a2e63b30af122d1e4953ee5dc0db7250e56bcca0eb2b78809dbdedef0884fbac51416fc5b9420cb5d02d4d199573e25c1e1f8
-
C:\Users\Admin\AppData\Local\Temp\UsYU.exeFilesize
119KB
MD5ba588511446780e89121bdc5351af071
SHA15dccce3394b0963d174b59ec74b543117ff3c489
SHA256a197d81c0db4c4ad021e1c4eee3e68d922ab0ecb1fde705d8596984b690ac385
SHA512857b7ac38b73d16380df7cb4b16c391b7e79a59d91c1875d72060affaed7ca753609d9fe68d128a21fc6df2490becf9d1b716879c78c4c207e02f3c6998678ea
-
C:\Users\Admin\AppData\Local\Temp\WEwq.exeFilesize
351KB
MD507d0c7b0197301f7c97e41faa0eaf4fc
SHA19db37c5af11f44f9ac8d6d74ff6b2e20fdc08c26
SHA256a8e1b12b61c6554d699e01b85de35310dc33b7c32419e24694a39ae494998b9f
SHA512b49a5f2444faa188738023917110a7ee4d2c1f69b908c2745e8209d36d0d665128dfab2aedd5097cf729e0de73758ca3bf8759f7232d5ef76a70aa08da9e57e3
-
C:\Users\Admin\AppData\Local\Temp\WQEQ.exeFilesize
483KB
MD52356ec4822d74d098f9d3d1682952d1a
SHA1e6a5f91e8e50d31795e29f718f80a97e98707c7a
SHA25657954a0beed1f0d26111a6388e5b48a0c3e742f176bb47056d7cbcbdb793ded9
SHA5126089e3db00d20d6159bd30a496c6d8a64ed49cae51fd6a22cce2521213fe9a026b95fa805736a7eb4c2509a640f770d8b93eda4272168b34f6a02ec9017b9c98
-
C:\Users\Admin\AppData\Local\Temp\WUcI.icoFilesize
4KB
MD5ace522945d3d0ff3b6d96abef56e1427
SHA1d71140c9657fd1b0d6e4ab8484b6cfe544616201
SHA256daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
SHA5128e9c55fa909ff0222024218ff334fd6f3115eccc05c7224f8c63aa9e6f765ff4e90c43f26a7d8855a8a3c9b4183bd9919cb854b448c4055e9b98acef1186d83e
-
C:\Users\Admin\AppData\Local\Temp\WYMi.exeFilesize
512KB
MD53d686211302e41763938503d89a463fe
SHA10f67202937a52d8779140e9cf17d73691a34a275
SHA2565d9f2397adc835d65942f89336ef714b5beef27b83929336edea12517396dd6b
SHA512a7f16a2238b85e2f976c7d818ff457e6e60a25f37d823787082688616c50b688eeb3859ba52c4d2daec32108cb178bf7897099c0ed9f3fb2f3044df53b5d2cca
-
C:\Users\Admin\AppData\Local\Temp\WkAW.icoFilesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
C:\Users\Admin\AppData\Local\Temp\WkMA.icoFilesize
4KB
MD5ee421bd295eb1a0d8c54f8586ccb18fa
SHA1bc06850f3112289fce374241f7e9aff0a70ecb2f
SHA25657e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
SHA512dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897
-
C:\Users\Admin\AppData\Local\Temp\WkUM.exeFilesize
865KB
MD5521a6244d386b38d739cdbd058824bd7
SHA18cb21e08f8134bc772359bb390277e7c59f8b3c1
SHA2560394301a6c453fe29d246b8d8f9fa9d2722b2ae2927f891efdf2d25fb0a90d28
SHA512959f35d4e143eac66699ccc37104ce26543b1254adfdf7bc64eca098144d781bd8530e8099639989d421acc2e2c728cb5df6a6da2bb29574b1093ce6c98dc486
-
C:\Users\Admin\AppData\Local\Temp\WmAUwIII.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\YEcA.exeFilesize
430KB
MD5cbb2152472b00c6d10b0af3080d515db
SHA1b6ef131cf6aaf053beac6d48bd5d8f80978b2283
SHA2564be8e611dddfff1043e9258fcfa405fc7cc89657a840a58dd9bd4f706c3ccf96
SHA512cc8ec01479ba2e818c30e4b44cd96b1cb5a88990c86bd8d913e4a2b899d9fdc24b3cebe6f35e45104e5b655d663b55a67de96f5c7e6a4b3213ee322f2a5d6de3
-
C:\Users\Admin\AppData\Local\Temp\YQsA.exeFilesize
554KB
MD508f726b2382b53a79a4ffd3a99cf4430
SHA16a04e2c2dff6664e9051eb0078c711f6d1b92b05
SHA25602504322ef0772457cdba6a1e3d182fd05c0a849b9b5328cef931f1e0df76618
SHA5120563abbf9fbe44e818e5fa36745d7d17c956a961f1d309ce5c4277c059bc1b0a5e5f8421317006362d4e680a3801ba1ee3a48b9bee944b26f966615869a4a009
-
C:\Users\Admin\AppData\Local\Temp\YUcS.exeFilesize
112KB
MD5bc3839fe28e92d293bd209ceb33cbc7a
SHA176bcad8b7b5bfac944b4dd78f015c4878afb9ad2
SHA25625ef66c32003dca34b895f82562953a5ea27f52a32b00148aa9fa1625ee35e18
SHA5129c4e39ed00a64963e69956c309618990f9aeaa568b93b6c59b3b90cadd3d99b0ae6b1b7bdec81f655fe0c4d52ecd4390011b9e855e56d3c577b0e770836c7066
-
C:\Users\Admin\AppData\Local\Temp\YgwU.exeFilesize
599KB
MD57a6fc8ddc0b4c40535ffb893652d953c
SHA1b0a1a8ee7b75d90cf06a1c6c54454d8fd6449e57
SHA2566148fad7e27fe2c8a6270e9f5b56127c020a65b23c096d525242ccddd281c7e2
SHA512f0316bc65d7c596e1a40b737b63394cba066d6e386ba791ee0db80ec0c42d2c025d7bbcfa0425fb372b69f277eb3c6905f6170037c2f69954515ae128323467c
-
C:\Users\Admin\AppData\Local\Temp\YwEA.exeFilesize
720KB
MD55ac493f320fbe0e9340faa7725299089
SHA1be6d6e524108ec79dd0bcb0fb29f847c66393e6c
SHA256f0e65f48625fcdf5494c11201c7de1724f2c7ae3135d35dfd5a0b0460240f439
SHA5124f09f1e4a8d1659cf93cfe8876704b7297cd48bbb77160b8c0c2686f71b64a879dcf76e73544c1c2700365894730eed0a23e08160247eb62be7d0fb8e165c8a8
-
C:\Users\Admin\AppData\Local\Temp\aggm.exeFilesize
745KB
MD54fad73591af09ceebc3ead9f894c9db7
SHA1f97f56718ba0fe08e44310779a5cc03ee01c49d4
SHA2563ba63aef7a911c79f02c0e8710c79fd75e99bf9e67c161a48909da7a50654029
SHA512a7cf476242dd0089816eddc00f2fe5623ae6da87cdf0c39c29f274db373131763cd73bab83041e87d81e5a75777efe56237e1b99a52a732e103b6075d0aabc7a
-
C:\Users\Admin\AppData\Local\Temp\aoEI.exeFilesize
115KB
MD5ed220f93c10ef5cfd85a9bc8702456fd
SHA15473f3a64e5fff0b6a56936b667ede8d1ea6448b
SHA2564d34b20e4af0981f24d896c65c691930e9d79caa7fafdaa70785ebb324145d64
SHA5128b231d397edb80efec14cd61c5f1b2f1706da4bb1ebc2a0875f700e76c58b0e476023bd1ac49f797b76243ce6116d1b6357a8c4c649263de2f919cbab7c01b9f
-
C:\Users\Admin\AppData\Local\Temp\asAK.exeFilesize
114KB
MD584ccc69567f65b2d01a9a08e3e6d5d9d
SHA133344605ff729cdf538faa8ca556afe901a31928
SHA256fcb613ddaf6eb245cf31d6a759f732aa68e8931fefc5086f07c1613aa496dee3
SHA5127b19d965ebc55d4f7679ab8def2e4f51adcefb975a0ba938f2728d5a3e8f7dd58c8111aa72c813fd6a3b2d491eab6f6b46e705306938be8594860208c1c16c75
-
C:\Users\Admin\AppData\Local\Temp\cEQk.exeFilesize
110KB
MD5d48c124582fd475171b7eb42bdaf0311
SHA1f81c0a7b58ae978d05dab717f4b361711f4caed0
SHA256a1d4c1553a5e739b62b6516bad1204e359933acc4b67114fd9abba30fe1abd2c
SHA5127b638ac79797f0be1c1e952b51e648bf468bfe738a6ce9b523bb9a8f45cce6474f6c419fbd283b4f0586c42fb026ea8a286083cab6ef3c4e174a5878c7772128
-
C:\Users\Admin\AppData\Local\Temp\cMsi.exeFilesize
149KB
MD55d4a0bed35724b695f84490dade571af
SHA10692e9be6e6a5fd26d20e9eea5782bf415e2da98
SHA2560746e5b52505a2bb44541abc2cce57daaf7d243a2ddd23c4e8a54947a50187c7
SHA5120ac180aafb031bae8a26fddbb995c5e06ec44ee0bf8a57f44471dfd0b39c9b4dc9c2a3cfef6473e95c3bbcb773cbb974289e6139237a1bf5c887a244d705c80d
-
C:\Users\Admin\AppData\Local\Temp\cUgM.exeFilesize
110KB
MD535d665c3a076f8984770375e05811ed0
SHA1c5efd6c1ce6474d8aafd5d11fe894f4e69ae7a23
SHA25614f415a61885146225b164796c4dc54c97db52a949621fc9e5cda461e0043880
SHA51247894895c5da6d82a8235ba1bc0abfef4a560e253dd52ad39ee0789214accabf4057012ff593b7d0c1540f093dc34de988f07c6593e1942dabfabcf89f62b15a
-
C:\Users\Admin\AppData\Local\Temp\eYwM.exeFilesize
111KB
MD5df5ba7c3f7e9687bdbd062b97a7ef68f
SHA16869d53584b65d4e951d9f31ea53b7807876a429
SHA256fd9d57f4eafc9f4677ddeee3467071eaedf92bc27cd58e7a6f531313ce60b401
SHA512b75768ed9f5a55385596193621bdf2eb7cea27ad0d1015e0b7812407137074f25313e4fef9bf169181f8b624f802e67dc072dec7ed8a271f8bb3af5e73556814
-
C:\Users\Admin\AppData\Local\Temp\egEe.exeFilesize
148KB
MD5d880fe4950294304a91cb67cb50610ec
SHA1c8210fe8f773df2297d1a93ab335bd05fb65225a
SHA2566885d566bda8eea33c2942d6f3c5a52823720ae39b3ac5f3d653bcdcdc483c49
SHA512c833a0b5d625069b4f01edb524b647d6d08e0fbeba79495d184b0bf70be688de4810c89139522678b2a2bfedc6ca88423bdcc52f171dc740df3ce96d1ed20942
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\gIck.exeFilesize
153KB
MD5090c8f5e98408ad3c143771333aa0c96
SHA14659abaa66aebaa8940dd6fa93e59099ab247be6
SHA256ce43d1b832d70527ea3bc13736e269ae58ff35f6462be60ac6a636a156b0bfd2
SHA5129eed0a5fe0cb1f254e6f630936a5c924813ef7420a750911995add5228349c5a5fce30fcb8299838eeb96123cae32f296bd89588bebccfe521333fd1d0f81bfb
-
C:\Users\Admin\AppData\Local\Temp\gQAq.exeFilesize
112KB
MD5294c80ea878b98899b4eca918af86716
SHA134e578c18ebcfeeb28995c83b0653a477fcbcca7
SHA25602375c97530f5d5301a7b73219e14c8ad75e1a2d4da92f758236563ec7c3be5d
SHA512f79688ab3412fbcd59df50e3605de127524c689c192ed82aea2fcb80a6ced691623b528fa2ab97ae0951febd228d02e7051f9ae0d3d015885890b3500649d177
-
C:\Users\Admin\AppData\Local\Temp\gYgY.exeFilesize
567KB
MD5546f411311e9a3173878bbbd8e373e3b
SHA13d26f13fc910e831c9120d9faf3208902ad62aaf
SHA256bb3968135941e66b878f3f71c74df028297c78027ed94d36c095b6b40fff7782
SHA512a705f805e18045da853f8953eabe33952813969a9b6f186bfd046425569d43b8e188a45418ae79e3a906dd9a6a414bb7f7e989ad71637a3d84bc5904899d9faa
-
C:\Users\Admin\AppData\Local\Temp\gsIE.exeFilesize
237KB
MD561bbf77014857154d9a45b425133e093
SHA19d5c55aee2366c8e53922c1eb89b0d4c8d810e01
SHA256b793e896043aaf604fff5a093bcbbe29963fc95852bab48fb0a320d6873ee532
SHA512178aec3b6fa9d0797e06d3a40c8e88b7a22855c48f79e411dc56baf8ad277b94d8a822f581e9389709de24876f62dd4886eaaf8e4ada75b48e7049ad4fc9caf0
-
C:\Users\Admin\AppData\Local\Temp\gscq.exeFilesize
235KB
MD5035ff5852cec92bfb7ef6b488c5a8528
SHA11f7d551626870b867a98921c7d86a24d7d3cf520
SHA256538f70e264bd5a0ca0c58fd4dc6e05e971e5afcb701d3a714cc2ab529045b0ad
SHA5129e43cb0fd580e6bc4ede9b1d3b0ba415391354bddda83d83a01dc11725ece8eb13cb253e4990093d41048d7988dd1b798b86b7bd848423813891531449bc52f3
-
C:\Users\Admin\AppData\Local\Temp\iEsK.exeFilesize
116KB
MD5beeb0d98246f7bec994150b92e2c6816
SHA1374e9ab5a67b42c2885cc5ff5d688eac30e3ce46
SHA256afb5a634374f3c728d2507cf577256abfc66f6e1a0fad12e9f5435a9348a46f8
SHA5122d440ee0bdd9c375323bcae6326a255c7872facb28e52443db0ea82f2d5bb69c780f94de09e37e82ad2b814ffbfe55dee4699541c2809157728c13a4f9f53c86
-
C:\Users\Admin\AppData\Local\Temp\iMAk.exeFilesize
135KB
MD51f5c5403120ba7f29b9be79749cc9ce8
SHA1144744f316ad808199eb590ff774187785af98cb
SHA256a82ce6211b3349e4a40e448de3e88a7da87d64797368ead1630d39fe15f503c5
SHA51290e60d0b197f8fa264b9a4ba3438cccfb5a2ca66f9f064234110ec6c55dec44ddce93c585b81d9654747ac6a74227f8fd9c5b8aec1ee28f53dcf207c81583a0c
-
C:\Users\Admin\AppData\Local\Temp\igso.exeFilesize
111KB
MD5863b9a43504370d7383db4582269681a
SHA16d5cc06f1c107fd5b95e242aaa3f3fb95d910f13
SHA256704cc48842e44fe4ac4fcf3b4b90bf37540a22d8e3ea36dd79386f1ef8c33fe5
SHA512ea00c5fd21d59fd42c069e3eaa4f122cbeb81bbc05b17ef9054b7361f2541af3f072989e39d1f4372d112751dda354e8efcec95397b81737207f5d19d2877e53
-
C:\Users\Admin\AppData\Local\Temp\kAsA.exeFilesize
115KB
MD5a7184b3a1c5a52266ba593011362c3a2
SHA138e00bbb6ff2790627201478a00d40d4cbc9999d
SHA2567eb5fcb290ff5eb6757fd1bc9f6e107f0772104a419be9ebb4218cddad708b91
SHA512444b9870aec8c1dd6399545dd8624831476162d7cbdfd5db7de6d41816bae4915e872536ba7c1c5b8ac183a2aff28ad5a2865f95c2a8d5c91d0d6a18d17e798e
-
C:\Users\Admin\AppData\Local\Temp\mEwK.exeFilesize
110KB
MD51d2c6221e12109d8f34c0dc0e080f204
SHA158698923a718828e86b0e6a6adae9b466b55a5aa
SHA256cd8fa255553455e80ff2fd3fdc9619475a1e537343b352e3f8b17be9e8b9ecb0
SHA51276b87d0b9f926d879737085b336ebbd251294d0d30aa238fef21f82b031db9f9fe258c11132f278c43e65aedd0813729618ed2d70a58a581a6ae3bb029a1ea49
-
C:\Users\Admin\AppData\Local\Temp\mgoY.exeFilesize
112KB
MD5e41c1ca766727316b54f9a5f94159dd3
SHA1ed54ad55d9b1b630dc5d47401c828186a09c6126
SHA2565af698b823c86ca164bb3fd39e11b0f67be21f206e81ccf2346e8c4b0f5e4ea3
SHA512498e175cf5ef787d7f1f8a9c5dc797503e8f76266ff3ed3f83dde731c2e8b5854bff6415c8def78be1a2919b59071931cb6602f62693a37fae8ac7f4009197ce
-
C:\Users\Admin\AppData\Local\Temp\mkUw.exeFilesize
446KB
MD583229251af3818ef85f6f5b3f087ab8c
SHA10459e9d286f122655b0ae18b034647be0d82be86
SHA256a24d7b3478e5c38cc3511f72cd86480a50c2a18b3bb0dbf9bca3bb5d1291e9a1
SHA51278ebef42bcef437135296180b63f7e9f2f2acf813e85ade69cf45606dd83f7178bfe0b620a43849510fc28e8cebb5a8825d4561bc5c200c5778d17f4456749e2
-
C:\Users\Admin\AppData\Local\Temp\moMo.exeFilesize
113KB
MD59147640a39653f97cc702ee66817c978
SHA16aadc53c05c8d833fe16b6ce88db4e5b5f4a0f8a
SHA256789354df83a80a99e817c294cdc71bf4d1b0ba1123c8a14a62b58faab536cde3
SHA512a0030ed3f5fc1095e7ad416db9fc3c51b523b02af2e28f7e4261a0ef49cab547353c460cbd0829d5c3ac1a77eba1cb46adf0f284c53d74f680a0fda522a6d23b
-
C:\Users\Admin\AppData\Local\Temp\mwQk.exeFilesize
239KB
MD5bf06f1f5779ea53f38636df0abf9ab90
SHA170aff15d0d718dff56f9a9cb95a92a594b209cfc
SHA256197d116fd57688b81dfece82f64e82d20a6bf036b36c69a3b0dbaf3d6aa3fd9e
SHA5129ac0f0198e600fdd1aa2d91d9b663adb66cca37344f525b163a2fe5f0fddf6056b2732e65631de0136e3bd719e9dc8ec9036336e3a26357f27d86d6a49f7024c
-
C:\Users\Admin\AppData\Local\Temp\oAQK.exeFilesize
140KB
MD5549ccc4037b32cfda756c25345d93599
SHA1f0e7c5ed4c5dc8ddf1bc3703a535957901482c4e
SHA256893b456373270125f3e8b6d1388f85e4c4341625c5f4c1329796a9d19936b404
SHA512e1232d60cc814c880c9cc571baa30c81e29aee068edcf07e99a6cb3aa577ce735ec5fddbacdf79a7dbf77c1d7778886ca38d9ac9fbc8b2105d70b1c1d4eb9e76
-
C:\Users\Admin\AppData\Local\Temp\owAa.exeFilesize
871KB
MD51ace799c04903a9ce5a4f1578b5e98b5
SHA148a9b6fcda712a721bb9d3c307a7b1e988340de5
SHA25631986ad047a8b50499b354acb5b6e6e2d46b7546a4db59794162ff39d90cb322
SHA51224f840f96b087fbdea505bda328a581576b86b5309338ce3919023c6ffa7f3fa880ba6f89d008a52b1a863e1a4a615d9a0efd41aef7c7cb3293e3dce13eb88ea
-
C:\Users\Admin\AppData\Local\Temp\qEIs.exeFilesize
112KB
MD5d8d70e361148078d9500b6f5439caa9b
SHA1cc821cec6f236db201b30ec72ee11b0bcefabd77
SHA2563a63901818c5bbaa8cce9fbe045dc482ae6cc74cc1fb21b43f2d1d1b0d65a6b8
SHA512fd107012fc02189e74a6e8e5aa8294d8df578891a2b49d36daedb5c5c9d6be657df7bf7795dced0c13af5983f9500e06a78c40ecb4c6fcfb6dd869b6b008d7b5
-
C:\Users\Admin\AppData\Local\Temp\qMka.exeFilesize
111KB
MD5dc32beca44254a609e23bb9b2707fdfd
SHA16fb0ebbc7e5245608e95129b7f2d569f52237ad3
SHA256308264bb4b133192019511ad94d43ab54a15e23ca6e8fae16ede4ef03f98ae46
SHA512fbac7a358dd5bfae44a4c0316e6023bb21d2fbe41c43a8ce1042ab9b5b2fba21f7b259a3bac0d42b4de9b179714f1e16afb413ec3865f333617676bd5352e559
-
C:\Users\Admin\AppData\Local\Temp\qUYm.exeFilesize
131KB
MD5449c620914eb2842e59879497f963082
SHA1c697cfe7dc46852cec3f7290b256b9ff00ce56fd
SHA2564cd0711bbed879d81ffc1225f08a5d8e7847d5933ba26da09df4575bdbd55f3c
SHA512ced25d708bc49fd60c3faff706ef1c83cc229e67d82924c22da751a8aaffcc2ca4bfd422ae07fdfde8e14a392a788f13552d8d876499ba3a7a9b1e26cc744481
-
C:\Users\Admin\AppData\Local\Temp\qsIs.exeFilesize
109KB
MD53a7ca429dc86011f09acd4479c5948bd
SHA183a73451aba78b9d2c0ad7381f704cb8d4de70ba
SHA256f3f0c84f96b024ced213394cf32b715fc22e082f28b0f562cba388e64cc98d09
SHA512ff06adef69e42e9518be49ec918822a7f387d86ec2673bcdffaabbdca75f058ff7dba17369333daf8e909aee69646cde38eb7c565e1052248908cb5217590154
-
C:\Users\Admin\AppData\Local\Temp\qsoC.exeFilesize
117KB
MD580c78fd8e59af2c6dcaf9d683c38049b
SHA12d48137270f2f8085a79621bf01f742c9933a5b7
SHA256566179632e1402e69fd4af5171ba2801560d8d61259fedb8c977d0b026b23282
SHA5123695ea0b9e4e9ceb99fd341069c96c6ec6ae2944b513f41a9dae75ee72352afbf46356de1667bc43ad1d55d7197625004b3623be52bab9bca91498f57c0b42b2
-
C:\Users\Admin\AppData\Local\Temp\sAMK.exeFilesize
112KB
MD5f6a12ec8f913b256a5a2bb81f16b210a
SHA10c3ae8e00418fbbbb8d5252cc401428c3cafcc03
SHA25655c9eb9bfe1eaa5fe7d631aa0cd6b3e15d3f1cd123d1569d3565cacd7937db16
SHA51265966c1fc79d28df4729afad9ed81b112e000553e9cb487829a850c8b9e523a1127aad529f681a47b99091723fb63f27feb51e8649ecde6596f7fed02dd1bf4c
-
C:\Users\Admin\AppData\Local\Temp\sMcI.exeFilesize
744KB
MD53489c3f252ce47734467fe0f75957ef1
SHA1b081748fc1765fe2fc87610425c49d99d27117f8
SHA256f96a46311fad95e8e274b8f3c55b34842de81ca0bf02183b499a5fb2cab02056
SHA512195a516b8f27dd956cbf61e25e0a240671a3ee8006a4427227168c67cbc35681fe48052c87677ecd63aaa9c0db71c220a4af15107603f069b3874f1a4ce12b6f
-
C:\Users\Admin\AppData\Local\Temp\sgoi.exeFilesize
111KB
MD59cfff3e200478b39ea00caad53a0db4c
SHA1fa3fb690f933b0e060da387b02a33f5a79ed47d9
SHA2564c1add3ee3748364aaa3b5d6cb20fee544e1e5bfd75157117d7edbe58b2dafe6
SHA5127a2131040158aa784c35c1b2cabd5c25b7dd871499d7c8c2250b771c554cf5f4080d85d3bbd98845dd46352dcc3df67ef29ef1c7dec6371b87400ae6dfef17a8
-
C:\Users\Admin\AppData\Local\Temp\sscy.exeFilesize
110KB
MD5597bd4a7eecf2117a6381091a8b8023d
SHA1e965a4515734376e7c844b711fa60808c8a74a48
SHA256a8299de05afe928260019a3f9e3c0dfa6c8e8d11e9018291ec71d31ac060efb9
SHA512f0a08040e08a34f3c910054f07102eabf8db0712278a75b1927731556885a64f8a1eacc53946443d7030f2eb78acd8ad9dd766e9a19b06288f34a29005612d76
-
C:\Users\Admin\AppData\Local\Temp\ssgS.exeFilesize
121KB
MD5bc99bdc715a7cfc01fc8fc8cbc4d7308
SHA113793832ff9f9465e2d3b245527153b8ee5be095
SHA25642a2cd4ec5dedf95c3af8217f7c08e932751db55f75f3e8804c8848079af0fb7
SHA512049413adeead3453073068546b002a0c9e00784c4c7881c256bbf18387adb69752db27148ed676b15eefe0253d4de6290303761d782b8bcc59834a4dd535919c
-
C:\Users\Admin\AppData\Local\Temp\sskc.exeFilesize
111KB
MD564594f25ff6e0337369e71eb5ef9068a
SHA1c6624fbd145e14ca348c299a3025e501815f7290
SHA256b3455b8dfafd2ebc012eae0ed216c575983b11afd7486662b123ec57713b5c2c
SHA512b108124d787de0b548207248d0e9cd5c1ddc1ece1c5f5af18ff83df2ce4959c2c9e36860e1efdaddef17d1e192120c743691ab32cbb154aac17db3f66b417368
-
C:\Users\Admin\AppData\Local\Temp\uUEW.exeFilesize
118KB
MD5261ee0d716c24baeb8ea2c1c3e245d8a
SHA11ac18b20781e470edb3c5d9854221d850f27f938
SHA2563cfb5e9d8002d7ed73d51bc5bd0eda4297cf2e9093175d4bd70bb2bba2858829
SHA512743f0218218a7d762d949201a9f41d6e736caaaa7a7abdb3551f273371aa571e17323529353cea07ae3b2af88e02670502a6d6c33bc59f63f76afefb8ea1d95f
-
C:\Users\Admin\AppData\Local\Temp\ucYi.icoFilesize
4KB
MD5915b89b32206268168c5789d7c55f7f0
SHA137aa8ac4a21bfd3756457063f300caf5150d9cbe
SHA2561aa540b0acfa68f313963ae32ca68a5b3cefb49217cbf3b9e0b9eb98b9b94b6a
SHA51235ed5562ec9fcefca9bc1644dd8fd7c28ead223eea2100eee38c51224332cc071cb7a122f750144d1d2b38b3580dfd8025cc59e0942a97f729ac39bf3fbfb9ee
-
C:\Users\Admin\AppData\Local\Temp\ukQw.exeFilesize
1.7MB
MD5bc6c8a6947ce77ec4b2de5b5a2f4d86f
SHA19ba192a3f26de6d196698fb12e2316aff6c4eae8
SHA2565a649e696b2026200c696e5c1b3525f8d6467a1f82723dae108c313d1e26577f
SHA51213cb0db61fe046de8b342324e9473c9482804c2633fdeda3ecacd9e5d09e25d5e1708f3449017c2d4f5e89068957e6d7c9c8032941740c9ee4409803ff01d9d9
-
C:\Users\Admin\AppData\Local\Temp\wMMW.exeFilesize
287KB
MD5b5a7e04d87a96715bca2026484581ec0
SHA1bcfb90dd7b148338d84be68fbb0b0479277f134d
SHA25660ed522aa43055c910048a163caf31e43f8d77401813ddb6e035c792a6033fc7
SHA51218864565f08d597433cd74e911195febb99b26b19a8d94fc5c4a2f8a31f8975376291c596e4f1223026a36a6a2241f6611236d4c31bb4f347e635224c1a78c72
-
C:\Users\Admin\AppData\Local\Temp\wkcY.exeFilesize
698KB
MD5ab637606f08743f6f868b52ac467ef28
SHA1d835469d64a739bc7a4e54a99f43bc47599b37f8
SHA256e2580bbcbc21e96cfa8e4849c35b64964ab8065281db90c941b17ce7e897f74b
SHA5129e1d799b73442f945193fa03c7fee9ce815bae1c5d801b5e724177127bc448cba3630b5109f37f1ef72c308336dab05cfff4acb15e254aee4ac062c2c99f8564
-
C:\Users\Admin\AppData\Local\Temp\yAIs.exeFilesize
140KB
MD555297d3528bec0ace032a7deddc29b31
SHA1fa1e57361577e8ef860d04d6f3efec6c43c4932a
SHA25617523292ed6d4d0975efb421c88c856a335e80bf189f18c2ea78b3f549c47022
SHA5125678bd3cf7d1403df1e35b3be4f8a60662e684f75969de1034e69c7e1c8562fac499dc075001876245457dc1dbf7bf517bfd2fb270c6284cb9e3f2cbe384c986
-
C:\Users\Admin\AppData\Local\Temp\yAYK.exeFilesize
112KB
MD5eea24cd76d9f63c518c087bb95fe39a7
SHA126c1d9076d9efa2a7e68995b20a842fe8e90b2b9
SHA256e3380c8278603c0b38ee121e77a8a40b52f9d08e7a7b6b14320b8573a7881032
SHA512e8ff14ac756b5e4fcfd858a1e31c7d5866e27c18c9d9a011d8de710df5b184666d1d1b346715b3c0e9d4d251ff6ce5d7ec8258ed8749acbe2ed8b40975a8e459
-
C:\Users\Admin\AppData\Local\Temp\ycMW.exeFilesize
111KB
MD5f8bcc0d7d7c5eee328c07b1f206a0013
SHA160dd576fa97788c60fc94e64ba94e0c3ddfbbd93
SHA256f4667dd9a8ef074b8075b3aabf6a973a5a456d09c96102b07746a94abe3b00f9
SHA5120ee05c726c6a85571eb24c1f4cfe30bdea48db37d2a0483690d2a42b59946364890ac4f2c90239ecc7e1c8dafb1592f061f9d7b96980f16384745082dd6b9bbb
-
C:\Users\Admin\AppData\Local\Temp\ykUM.exeFilesize
115KB
MD5f1aa36c43f2d2819abcbf86844e408c4
SHA154f47cbb43b6dcc8b16474e1064dde7bd359d690
SHA25646efe79414a8035ff3aac5acaa4e94e66d3106d1f674ede5cebf65015b5a4428
SHA512b0743102d6ffd41b86dc2b9c4f77c3a19551218aa9d138eec02bcea96e2dded3730621febacf543fedefd6aacfee07a9cfa9d7ae1716b856465baf3234a18c40
-
C:\Users\Admin\AppData\Local\Temp\ykok.exeFilesize
122KB
MD5241f633da4b9a7d8d81d90b0c7928c9d
SHA1380a665f1f23de252541e6d046f249d148bf28e2
SHA2564ccb3edb89b8f72727306f9b65b22ad2de20e1e54ece1e3c5ca75d530c807ca5
SHA5127002be0b8f34239f9fb1d49ce0d7396c9091030cb81da604e67e9b4731e30b5b5281fd3feb07272e7bfb1b2c15bdf1621c38942c96686d731f0488cdccd3e61a
-
C:\Users\Admin\Desktop\DisableSkip.gif.exeFilesize
577KB
MD53dc0f3a72f588b8c1b87391d1f8d6f75
SHA1d6239904ff5899caa924d3e100912f43539da0ee
SHA256c8b124fc79b81986972d90427f9ba6939055a2f46ea3aa50b49e2ed6a041ac74
SHA5120e4a63cc0a9bfa7841df26603d02a03aa187d00570588ad9f9a8e4fc6cbbf27fcda76315ea41a82caaeb5ab8883289fbbc233b97489b36907c68cb6f948c839c
-
C:\Users\Admin\Music\SubmitSwitch.mpg.exeFilesize
575KB
MD598d2594578db71930627cb6d92614216
SHA1bdb111a20a4d9e09459fa7b843607341af1c3a60
SHA2564cc15ec91883d898d493b2b6ee157c5ed9a90e043a67813f032e46108badbb5d
SHA512d6f8c36c986fb6010e9dbfa6afc64f7162a6985659e4ae49bea1d5ed9977a5b2432d0464cd0acad4ad2719f760674d7612069eab0a05f67a86e571456eebb33d
-
C:\Users\Admin\hqUsggkc\qoUMIkIc.exeFilesize
112KB
MD52c2f35681563db290b038e45fbff19b3
SHA1beca1d3cab7084beaa1b1aecd11dabbac1b734de
SHA256d0bc5d791004e1d5710380f5fce0cea8aa0a27acf28902d4ccfbaafe10eb0ff4
SHA5123d00381bc9bd5be7749d27aaa5d1328eb3d1ff81802cd4e764c7f199cb5623b19c40a6ce92d9acb2c74d874b1012d83d6873247793e1a5cbfdd1e14dd4a616f4
-
memory/216-76-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/216-92-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/220-20-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/220-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/668-112-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/668-128-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/764-474-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/764-486-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/868-370-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/868-361-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/916-450-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/916-441-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1100-170-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1100-186-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1156-414-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1156-406-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1176-397-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1176-384-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1180-182-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1180-198-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1244-32-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1244-16-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1364-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1364-80-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1460-44-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1460-29-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1556-456-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1556-468-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1564-464-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1564-477-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1580-256-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1596-422-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1768-266-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1768-273-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2152-335-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2152-342-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2228-281-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2268-43-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2268-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2288-68-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2288-52-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2628-494-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2628-324-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2628-316-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2628-503-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2712-423-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2712-432-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2964-14-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3184-431-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3184-440-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3316-244-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3400-513-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3400-536-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3456-378-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3456-366-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3476-315-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3536-162-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3536-147-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3692-151-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3804-298-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3804-174-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3804-289-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3828-325-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3828-333-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3856-379-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3856-388-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3864-290-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3908-396-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3908-405-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3932-221-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3932-233-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4024-512-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4024-504-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4032-264-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4032-255-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4060-15-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4228-194-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4228-209-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4276-482-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4276-495-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4284-116-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4284-100-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4384-343-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4384-351-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4468-449-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4468-459-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4500-139-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4500-124-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4628-222-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4628-210-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4908-360-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4908-353-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4956-88-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4956-104-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/5096-307-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/5096-299-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
