Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
25-05-2024 20:01
General
-
Target
2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe
-
Size
117KB
-
MD5
b6862b585b36fabe2dfc59188bf8cb07
-
SHA1
7c25b7b864b2f5fed4f9f916664fe0446e27b797
-
SHA256
98d75a3c50e0f29b199a323a902f33a65bebe169a6532f5d2569e93289a1f654
-
SHA512
b6258a0b4ce28aa8b15d83b9369e5d04533d0123a0e0823bdbf71908f5dbdc3383fe649bd9cbbae1cc472f623b852d4bd5075125d1bedaac3b12366912e4b59c
-
SSDEEP
3072:LcCzV5J5MeC0hivrhYtrS22tUb0XqiMa9mSg:LcyIYhSYlPQXP8n
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
UAC bypass 3 TTPs 64 IoCs
-
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TKgYUgEI\jYAgUUsU.exe"C:\Users\Admin\TKgYUgEI\jYAgUUsU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\baIIUAwU\ngoQUEoM.exe"C:\ProgramData\baIIUAwU\ngoQUEoM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock"162⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1162⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2162⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f162⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eioYgcAo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""162⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f160⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hikkwkwA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""160⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs161⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f158⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUEMYIkc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""158⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2156⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f156⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkAIQYwY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""156⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f154⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TasEAoks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""154⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2152⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f152⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kqowgMAk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""152⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1150⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2150⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f150⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eeYAYoME.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1148⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f148⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KYkYcAoA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""148⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2146⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f146⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PWEcYUEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""146⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f144⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmsAowQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2142⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f142⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DmEIsYkE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""142⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f140⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QgEIAwMI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""140⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f138⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEAMgQQE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""138⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2136⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f136⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISUcEwAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""136⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs137⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2134⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f134⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WaEUwAQI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""134⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1132⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2132⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f132⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AqEokQgM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""132⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs133⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1130⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2130⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f130⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rOYgwcYg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""130⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1128⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2128⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f128⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGckkQwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""128⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2126⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f126⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FWEIMwUk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""126⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs127⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2124⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f124⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmkcAQMw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs125⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2122⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f122⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAoIwoMM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""122⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f120⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OQosIwoE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""120⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs121⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kakEQUsc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""118⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZAoYMoUU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""116⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zWUQAUks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViYkoAoU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEEcsIQE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UaMgkAco.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""108⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eoQkwkww.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""106⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\myskcQUI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PuEIIcUA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dEwgsMAw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""100⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqQAwQUA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kCUMAYIw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IKYQEkQI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gWccwYUk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AsIoIUMI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XIAYMAwc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VoEIYkgo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jOsoEggg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSMQskwE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKQEkAog.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgkkIskQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEswkwMY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fIckAosk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nWMMEgYA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bMAkYcQc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lggsAAMs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AeUQIIME.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGIkEYUs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEMEAoAs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KgYUwMoU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vggkoQUw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BcooYoME.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\laoksIgs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqwgMMIg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KAwAEYAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CSIIAMgE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qAwAMUoY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CUksYoUY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zEUYEQsY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkcsIcAI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NwIAYsYo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAAYEwcU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUoIUcEI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kyYQEkks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cOkEsYsI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OuUgEUkg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JmwQwQQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jokMwgks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWYAEkog.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DiEQIIAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgMcMMcg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CIgkUgwg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SEIksIIU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGIoQsEg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkAgEEwU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGkIkAsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIgIkUsM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fwcAsQcc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oacgEkEs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exeFilesize
153KB
MD5995e22a89560ac0790b27e491250d3f5
SHA186b8e8ffe8253b9dfe1604fe5dfdcb9e4d73c469
SHA256173f91f666a6c4145bf66fd46c0dfacd2b427a54af1aa4900c75b268a7b3644d
SHA5128a7aaa07533aa24576ff200b3761c0c90deb9d7145d17846d793fe2b0f67ceee82ebc0450d0a38ffe966b3a76ea186973f83981ea43efce07407ff0a3c76ad9b
-
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exeFilesize
139KB
MD5eda9e91bf639bcb1059bbf240e156827
SHA14da2783307425684c1038732d1ff9a6fd530d5be
SHA256ce91b9a50fc746d48dc897176dbc6a912059659432d3b981b2995ce7dcead2d4
SHA5124416cbbf837694f5c819d00894b30b26e3efc97c003becd3313613b04dc8406b8e4c58f2f5d0f905b9e97acc650555c155a194a82332bd0efe4980782cc1cc0a
-
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exeFilesize
237KB
MD5001a3a2513be17f99fc020aad055fad2
SHA16ca5e0204b2767d7595c2ea201357199cc512659
SHA256ba04f7c66880b93abb2863ed724d83086405daf4ff8d54be69ae06f319e9047d
SHA5121d7e1cfd74fb7f527b24f2c8386fa2c347387864478263ae5f051c8992e0781d0a5e65a8f37e51380c6dff497f429cc107690ce5d13032a3aaca9c3f59743196
-
C:\ProgramData\Microsoft\User Account Pictures\user-40.png.exeFilesize
110KB
MD59044a7c0df1cb2882afea6c6c9d40bd9
SHA1138bd1649f4cebb0af927406aa9e4fb226b4e0a0
SHA25614d20312d798c9d33d52a17c4631e8bf70ca6c155e6d826b4a414c27da050ede
SHA5122ae9f9779e4dc102c8a2a4461d6e596ff4c61ac0fd1a409d0b3502d4076f47ec343b7f1272348e211ca7b98fbaf0be1776fec2fb907953be516af89a6c1946ef
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exeFilesize
722KB
MD5bad3eb09e4edc9475e05fa1a4d20f1eb
SHA1dbfedc421dd9355fd947ff07022ea59f841829d5
SHA256857cb4a215ca4552065f73f9b9e6cda26bb206e434015e76b9efde643c135b60
SHA5125873d1de06f9169c67419d1dbb5b5b18ef62b24366fb7f73bfd51a5cc84cd7e5fbd56eb593145c08246b3117cea8de60bed5eb1496a0731cd0d469e820eb37f7
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
555KB
MD5feda64325f2447aa37f2108e1ab61a9d
SHA10a24875d70ac83f61f60b2c8d0d29f39f14fc3b0
SHA256ea0870af2ccf8befc3bcaca5381a1402488f772a68ec86ef66b717fdc942b7db
SHA512c81ba4cc22470339463bbfbbf782f40b85417c8ea15c364a8c690cf249cec797d78ef6464e615b92d1611af7c831fa71eb43069edaa5398b53923bd40b604acb
-
C:\ProgramData\baIIUAwU\ngoQUEoM.exeFilesize
108KB
MD51b2d296d896083779a4db33875baf89b
SHA12a40dc02eff89a591cc11807ca7f65505b10931a
SHA2561ca6984150db0428c23f23e14dd0470a0345bf5c27eef0b4cd3f752e2923681e
SHA5120057b4173dd76025caa60204cca51ee245f3473c6e6ca8588406c738a34c96780503b236125a06fed70ac492bc5e3c3992a0b0320e67a2159910cfc87d7ae4a4
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exeFilesize
119KB
MD5c16420ae592521c5fac1675463debe13
SHA18422f94be4e60f9261f778872f28d31fec16b9ad
SHA256e3df31d0f6baaa0da8a503720d6b365a3634a0d018b8b0d7c707f7f14ee60d97
SHA512352cf699eb43287f21706890ae01dc5f5e4a4b94b57ad067bdf820991b7d772bd42432f507656e9eb2526d77ce18e060554976994cdd38e32c4107441dd73cf4
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.exeFilesize
111KB
MD511b99201c81413cb390aa2de39246546
SHA10ad5519675dc51ecac4ff7e4eaab715542c12d11
SHA256951c250de35d568b134a095e2d8b946098c72e06cb7b2ee1a76cf0f836062a54
SHA5126280e7e74ea6189d5519ce400a0856261b51e8ca5d063ad29b18c53f83b1bade5bffa10989882d518fede52c124e3c5bce59568ddcc7ca58f4626d265e799908
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.exeFilesize
109KB
MD590d7c5a7951070355dda6f51727891ef
SHA12e03d7c6a431cef0c071817e8e07b635fb4a6fa3
SHA256ebf29f5f7fa348c3f2507a01ecccf06ea861e546492029a938e240c9aad5ed1d
SHA51252dac59adedc31087727db9025e960369cef53b4344f1da5167463b0161c63815be45e6baca600481fe32b0b23a8b4639bd8df164a4a02d9a440b40c720861f3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.exeFilesize
111KB
MD59a06b8e5ead6fae04aa8d69dc8877d44
SHA1a5e8896b15acef150deb4ba64f0e478c058b2b23
SHA2562d1d626db7f696dbe346edd94fff85f401d3de2f20d3b183e5ec1c95ed68a478
SHA51244ec1b93f2f9d01f50e42b7a396695b0bd85c10123ebf68fa3b42d6d860531963cd3fd713ca59c229a4f06d60c79428c17cf0424af05fd97f858d795c7828ddd
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_b6862b585b36fabe2dfc59188bf8cb07_virlockFilesize
6KB
MD58b0271e0dc1d723ea9b9bfca72f35cb8
SHA121e0292b2a75f4ba5421e03ad29c5c6f00cd7132
SHA25666cb10ca453d7e731070da923a0f9a767f0742a4c50b0b3cc04b42e43104fa46
SHA512fbdde8fae5d182d0f07889e6a7442ea55fbae30aba66c67c1acf0158355ac0be507873436e4bbba8c3726315314d511660743a5b5e3ca2bd179d9b4854160fbe
-
C:\Users\Admin\AppData\Local\Temp\AAgq.exeFilesize
1.4MB
MD505150299f595a57e26dbd9bc640efa38
SHA1fcc1df459a2a887169c3d49466c56601f0564072
SHA256ccf4c0709774129768a2b8f27c9d98e66b32d712efcaeb40e1ccf4425235ff1f
SHA51255609992dec9f9e0b5258deb95137811522605878ef9d4c07685c0d334762d7d746ff97f8a0f43a82a8a5ea9cba141fbc238bf947083fbc55c738435a6827da1
-
C:\Users\Admin\AppData\Local\Temp\AAkk.exeFilesize
119KB
MD5e10d85aed8fba74c31964946201cfeca
SHA1420ddc49538924a399720e5598b39163ece645bc
SHA256849376771771c7d6d989f1245b85e84f704977ff8b612f66ded55539d55b53ae
SHA512d946a10ef069d3dffa50d326a31b2b8c4227d7539d4d5fbcd93820b607bdeb7fea9640b14dcc41bd1a5196e8330f26c5f974c84a19cab1ebb2997f08f61c129c
-
C:\Users\Admin\AppData\Local\Temp\AEsG.exeFilesize
113KB
MD50ffa0c9359cd7cc5f042ff624949ac2d
SHA1646b021e13c4173eac48a03a26e7f4360d59d394
SHA25627d2f9e519c46342366106352f97c87c25212ccb3ad38e98ab069bb48b8279ff
SHA51284603d64445ad5c0edd616f56da5ae96e6a11bbcd0cd1e3e0b52ab97bba03a3a7cf78f3e9649dfdaf7a581f906d837e184a327adc1b7c08849e366b251e608bd
-
C:\Users\Admin\AppData\Local\Temp\AcMQ.exeFilesize
113KB
MD563c26bffd0b36453e8b8d70126b9b324
SHA12aecc881a34e60610d89d1901b0bf5cb0e1589b7
SHA2563bc13dd999acd51469e1946c18b1b7034c1d036bece67204e0c65daca97036e1
SHA51264aebad82a61fa31a7bf7f327cb3586d9a3fedde24373c94376c3404515a9c8b089dcef4d0997046e785d91e91c8db9ce4b3c48f59d034ad85715bd10b266273
-
C:\Users\Admin\AppData\Local\Temp\AkAq.exeFilesize
120KB
MD5cc5230b7a47b63ac0e0de158df09ffec
SHA13c8985f3a121f01e6f5c7f5aea8f460e5da868b4
SHA256a233310c725aabd15f22e014daaec9310723a9b25d8c70d8f8baf44447fea2f8
SHA512618540b237a3d48e5994121c9ba5251b4217a90b8da281294e5dc0e2bde5d2bde5416e24d88406136edeb5ba915b2229d84b5015f029026fc0987d1288b54114
-
C:\Users\Admin\AppData\Local\Temp\AssS.exeFilesize
744KB
MD5cdbfe14a0dbdc64c6d5eb6be6841c21f
SHA1c7deabc294db5ce5f774aa3dc6b4a7cec5ee7cb8
SHA25613a1e8c42a832e7fb50c1388c083808cb90275f49ef6d32669874747276e8fea
SHA5123a345fd19011a046e0b8cd310d9932dfe05ec84017300129fbc08d4792c18adf1ac3baefd84d4d88c3b0763d4f2cd29eb1a5b4790093df2a15d53073fc7ec726
-
C:\Users\Admin\AppData\Local\Temp\CMoo.exeFilesize
120KB
MD58076733309e0608cf775aa73f08222d4
SHA1721cd84110e1e93e058e62079485cc291d5e5463
SHA2568d875b582ec04de3fa4f805349693a26cae4f68512cf9a18726f02050a2f6d31
SHA512d9bb0e71a79c1b29a8f21810c44d2391577951663bd2fd226af162b0293a0783372f22b295815793241d3155387777ad8955dd9468165cca171de34a38edc283
-
C:\Users\Admin\AppData\Local\Temp\CYAi.exeFilesize
720KB
MD5cfbe9e81d51973f7aabfecb36a382ab1
SHA12bf64974770283bc044a688c125b21ec1896e375
SHA25677c92d5515c00c518dff76502642c5854895390c566d877bfb0f5d43a012ecde
SHA512ed6ce8e8d48559fe56aa464b7d9737d9086d1e8794a6b1502941ccd3215f2456c2faef280f9ce86771946e3816902f39e281ff9927adf7315c6a3714f4ace72f
-
C:\Users\Admin\AppData\Local\Temp\CccS.exeFilesize
745KB
MD548db3640eb9379ec1f4470dcf950422f
SHA1a830bd4e4510a803f8ee56fadbfcec9c8b7a7fa3
SHA25630438e3753ea531e63f49a574d43dbc426b2c7813cc3e345ef5da7767cc8bee1
SHA5121be99a7794d1af6d9525eddebcf0809560db9622117510434f586a4ec9afef29a20f74ce6dd87ab2334f0328444d38c614b19a63133d8c28b04c4c3a5cd974ce
-
C:\Users\Admin\AppData\Local\Temp\CkcY.exeFilesize
348KB
MD5705150f30478331b0f35189b91ddd8cd
SHA1f5dd7de6b18d512cb6dcbf3415c686e6e40ab0f0
SHA256b175dab7e92b36cae2b7609ca1302ff023fc123fbadc7086752989c0fd662d80
SHA51290d20d335bc64023b20fc4c6c29aa1234de96da997c380fde652cb3b204d2eaa44896fb6b1d9c4cacce7a359f7298df39b8d9e1d39e2c8e4c733e4b9f404d612
-
C:\Users\Admin\AppData\Local\Temp\EAgm.exeFilesize
5.8MB
MD52d3de598257794d66ce4eea9c82b3cfd
SHA1418e1acc2da44004e0cff6caf8ba7df899bb4531
SHA256dd1897ae63349a1b27131df972ffe02f37e7ed323f090250e225766c1a06b932
SHA5128f9ad0b776105e14bd7cd34d3d96e6ba64a4c8a622c8f0d786a7664e88a911d3aea2ad9f872b8718446fd986df591e463cb5a8168f92d69bdebe810bf52ae366
-
C:\Users\Admin\AppData\Local\Temp\EEMo.exeFilesize
539KB
MD5e77238cc9f7b36ae52ea0bb74744531f
SHA1893993ee53b24060bac070f33474c8e1c7c8472b
SHA2560c600325dea7ca6f0faf46ca180a38da6e70110211e38fa6177316df4439f306
SHA5124773dc2cab1249760d83a5a0f20a953dbbcb5595805097fe3d52c4653127745113d88494d2894e673ccbcaea2f972c082772b8f33d7314a783236de1b2794cbd
-
C:\Users\Admin\AppData\Local\Temp\EQgI.exeFilesize
720KB
MD5f1d554ed91ae7b3094a23e7b11b181ec
SHA176615acdcc38680999159ec037f570997f6c2d72
SHA256313d6781be26131dc95885c49f057b148d4168b8f5ade7ad6cb90273eec0fdf2
SHA5121b2d23e0ecc52f96315725c10b1705240eb75fa4fc5998a32aa59bb3f6a5897b63334a58ddf15dc9534d1b1ada5e17507b4cd9cfb52175b64d797a5bf6546bb1
-
C:\Users\Admin\AppData\Local\Temp\EkAg.exeFilesize
153KB
MD5081eeb5b89fb8ade10b38876fd1cde50
SHA176e633d7e04c5021a16afe5360f24ebe53be1aa0
SHA25639a78a6d6595a3bbf1b4b8ef81d99ea52bc5d523106a912463a28f86a3c3e8f8
SHA512c9efb2f715fe7e0850efc85fe9e45aa3abe7b9f0c60bbc8d5f81627bd68dbf7eded93a39c4e0b1c1e404c9bc00c705b1af1446d1616e4d9a3c80db4d6b4720e9
-
C:\Users\Admin\AppData\Local\Temp\Eoku.exeFilesize
893KB
MD5be1bbe62441aac0ed623c99253e91743
SHA143e214f15ee6e4ffa64b9b905f64e5edf112889d
SHA2569487565f8769a6d44f277e3ecc1c566e64566d95c03cfd2f7cc23952857ceacc
SHA5126b3e9b80bff1dba38e93aaf902a29d527f767783757800caa54a869d6aedbe08be273f05e328d46aa68c30b7fd7c316d3953f68032523ab955406b68f3fef25a
-
C:\Users\Admin\AppData\Local\Temp\EsEm.exeFilesize
114KB
MD5beec6bdb33903a30d2ace7626f5e02aa
SHA1932be67ea915c65b0a0dd6ee03bc430952a53e61
SHA2565bc5e6205b320061570b26caaf894dde40e255755c97af6f0d396d60d27295e9
SHA5126a8c2441e7e3055e6f1e435f8191d9252c0c9129aa3678f2132905fb4f04387c581266ec9b351d9f0d652ea4618de241b9c910d0722fca80c85207505c667cf2
-
C:\Users\Admin\AppData\Local\Temp\GEcu.exeFilesize
118KB
MD51ed938df2894a9a2305ae9bdfa9ae389
SHA17b62bdf805e1f05ad24bd72b0025e5bda0302eac
SHA25656fdb4ded6bd3e80c0d26f80a3ea9d71199063fc4d4ad6ae1753154b5858c25a
SHA512f70fe93e547d29d5b5f0ba1e7419ea4a7b21f6130c7c9152c8f6a979def90f8dedc98641b57889b1bc54cc40cd6a07e121502a537adfbd2e62853fc9e2178c5a
-
C:\Users\Admin\AppData\Local\Temp\GIYe.exeFilesize
555KB
MD5782f75b7573535b5135f778d4ae1f72b
SHA1ac75a758a4bb4a3906305805e13c217e2211d583
SHA2560a3e7c5a4edd4b95b191e2cf014cf48858be7edb0053a4dd7e932ebb56889e7b
SHA512d72ed341879e551724524d7954611462eda5a0da1d976cf2f5288a6cd3604b09beef4e204076d2f802c3b9a5d50e6c1450b4868a129dea88dd0ed825324af795
-
C:\Users\Admin\AppData\Local\Temp\GYks.exeFilesize
113KB
MD54ec1b6f9acb0062cd63238042d7c68cc
SHA16629fa19a858c9972afe27f7245c6e639c2e7370
SHA256676e43fb2ba3011eb10df2c02234b485b1161ff57aed04abaacfd36b056baf58
SHA512ba46e3c1bb02aab706cacca423ca4511c4b188a244351e66c23a140521ec5fc758f27ee646a373242c5fc492f77a7dec423711ce06dfb3695b593a3ce362fb57
-
C:\Users\Admin\AppData\Local\Temp\GsoM.exeFilesize
238KB
MD5a0f5498667c637868897f02fca70ac07
SHA11d5749bf161f001b1ae985e7647fe024cc5c201f
SHA2567db426b7e92a681e5beaac7a8ae6199373b39ca6067f5e463e3734c823394e98
SHA512bc810d51f290e4aba59cc72cccdf417ed77c62d655269fd1631db34429a9f6bd320864661a226663cbee2d016b7e5530e4c8f461f212e337a6f1327e88b541d1
-
C:\Users\Admin\AppData\Local\Temp\IEIi.exeFilesize
112KB
MD53db23dbdbce0b7f8eedc5fae16bac17a
SHA12ed5906c8f36557eea181277f356b69482741382
SHA2560204a4b41c20cdbd59b23aec0652fed1b0ee789ad309883df2e03623992f17c6
SHA5129e5d3a01559d407666a42e4cfe3a1c28730a51e22206e5092e56e224fbb9290bac83af68892d04c3e6c05aca853b57cecbd2e3a48133d5b462ce8255f604f8e4
-
C:\Users\Admin\AppData\Local\Temp\IEcI.exeFilesize
116KB
MD55ac7eb1988c0b1a91b1ce826882c4aa0
SHA1d2d8f6790e4a0aa8d0f57b2e0f7be3692b60f4c0
SHA256ae05fb397d05b2b3968f757dcdc54457f2cd48f390f38835e42ab39cdba5e3a7
SHA512473fffe891eec08a5586153aef753d50b9c85b52beea5c06a0db07c95d2ef37ffe0cebee9cab81702679371a6cc15059656729e46a42fadf4cd8b99fc894b4ac
-
C:\Users\Admin\AppData\Local\Temp\IQcY.exeFilesize
112KB
MD560124fd102fdd59c770d1f9801e527e6
SHA1add255b176bc1ff82997cd4cea2f03b67ac0e8ce
SHA256127407a8a2141207a49e252be9b8011bb6b66e631adb8b4a4d2148ee1e9efcbc
SHA512c281de19c5d0aac236d92552d64134b7bf154e89494d627f0ce8d81ced87bc4eb1d1ad8349f62b8d195da0d1a916efe6ae4fcc4e95ee1a1e1fcdb00ecd90c1b7
-
C:\Users\Admin\AppData\Local\Temp\IUgE.exeFilesize
110KB
MD5393997d1e6f685a6932fdd740e8dec5e
SHA135f471527931a2e8eca2efbd05c957b5ce982bc2
SHA256aa253c5aa276bea6d714994ccd7c78ad50a1a68c455fe94c9b3df867edacd453
SHA512b0e788f4bdbb83c76fcdc4c981ee99c613a8a25c44b9ec1bad9fdad07933f9813cebb45100ff741987860d38504a865fd1c2c6b4b8612823fa6517acb824998a
-
C:\Users\Admin\AppData\Local\Temp\KMIW.exeFilesize
116KB
MD5a3e17edf1a7e4f93284cb01b3c73f0dc
SHA1817448ee9376b160a2a241211b4b84ea16545530
SHA256fee04a36b1dc3018ce6098014d57a30d734b9717ac856fef50089dd83976af69
SHA512d8b73b95114ed3dd47050a32f355325f823e9426df25856db9039475d8cf37347249a745e8835e96f2a7df5cb503502adad81e4d5f9ea11d1dc8af5762217328
-
C:\Users\Admin\AppData\Local\Temp\KgwI.exeFilesize
111KB
MD5d328400c5ac6d1d7ea71bbf772d7113c
SHA190c2c88e99460628d44063bb3fc3a0918d40326a
SHA2560c1564fde967c2812977dad80795dc67f27f262588e8bd0cb431038119a496cf
SHA512e9d4bb64393ff2c29badaf02786f22512ef7063eadd50fab46a1498ce70ae2297ba09ead9e456731d430b50896ba3b0c1e6fefc10b570d4bfdab5aa6435d3ea7
-
C:\Users\Admin\AppData\Local\Temp\KkAY.exeFilesize
110KB
MD54c05529bab2f10a52515537eb39f3249
SHA15dd9bb03d470ca5f0bc28c2fe6077afb7309d84a
SHA25683abf7abaeace925726f9029a225b8b50f7ba0500cb01fe364571948a5d807f9
SHA5128147e5fc6a2e64aeee2335bd7632cd03f933bbc58b624f4bc4712570cd336e010b01c73d8297183b5ca556d3c23dd1c413e552773fc24bddc30cd06103068a98
-
C:\Users\Admin\AppData\Local\Temp\MAki.exeFilesize
5.8MB
MD5ab9eb3442ef03acd75c06025aa724118
SHA1397fb0e24d0a56f146355d027ef6be0a9890c17b
SHA2560d3f4269d976b28e6f7d6f977f43e2a289c4a84036154fe60ab51f471a2a305a
SHA51273c26898aa3f41ea7b20b13a0e89255a242f4044dc4cac66241fd659fd59535cccae365b4e2e04107c7d06ae008b59dc4c21473de3601fb8167e1ae16c48a74c
-
C:\Users\Admin\AppData\Local\Temp\MQYG.exeFilesize
114KB
MD5e062448e21f62a6110662d2c15a944dc
SHA13109fadd71e18d43d6e109280e48a06118dcb086
SHA25657fa324ae7eb31184e7624e4bb1ac70872d5304e14883c5c715b5bf5e749e06b
SHA51289900cec9ef2c265384292804b4beda177324ab63b0383155892206468007cbd90bc95e938b7cda71e5d2a7e2bc8e1752e546dd0bae213c1554bcb703870cff9
-
C:\Users\Admin\AppData\Local\Temp\MUku.exeFilesize
153KB
MD514db52d3f72c0d3a098b6d6bf12728a8
SHA1c0a6956d2b813798ff001d7e16a76af27929e190
SHA256d905527b32d0ff4bf72534047d42f6463ce143086d8e09058ec94e90db8a7327
SHA5121f793902a9d0f749681412ba74e649e8abf637aea727a5714b2ee89273fdd7a3311ded6099f0fa5acaf21537a677639fe9bd314d2aad2e03e20a9f90db84c4c1
-
C:\Users\Admin\AppData\Local\Temp\McsS.icoFilesize
4KB
MD5ee421bd295eb1a0d8c54f8586ccb18fa
SHA1bc06850f3112289fce374241f7e9aff0a70ecb2f
SHA25657e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
SHA512dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897
-
C:\Users\Admin\AppData\Local\Temp\MgEo.exeFilesize
110KB
MD537a66a1034de711a6a960545c9db13c8
SHA1c4d4a55deec4f76a46a01231f465fca0ec35540c
SHA25652f85bea19cd035abd583ea8dbd5fd39154aeb677dc31a20f1c415f8caf89429
SHA51210c049c327141c644f6dd65cbbfc90168cea16c659f63832806ed8e34b67f7c820d19bd949abf52ce4412d5a60810ccc22d5e6cdf8560b704ea8aa6afe541dcb
-
C:\Users\Admin\AppData\Local\Temp\MsUY.exeFilesize
111KB
MD575f2cd7cbf25b24860163ab9f4f1d902
SHA1f2bbe23a741efc3bda81bd845d59a2f6ce6fff92
SHA2561605266fd0487e1d873a76740f4d2e74cfe9e1cc3adbc2bc7df6319627ee3d5c
SHA512e9ac40b2a21a8726dc1918aa1a678c318d6b25da43e9cbaeee69d5d1488acb79f2d760d4b5b3d671027ea858866601bffcd6a65be9cd23f6adcf3cff1f652501
-
C:\Users\Admin\AppData\Local\Temp\OkwS.exeFilesize
567KB
MD5794a5fcfb8373ade40509ba38645ee10
SHA1e7b7b33c5a94d3311bfdb093c1c498cc195ddd07
SHA256904bffef8a15e820ae5c49b87d5b85127ea0aae15b6d9321905e32bce15b24ab
SHA51204f7c80a011d0afed039d7ada790e845644df06de2fd54228cdb439ba9d59cd460304c6f59145c15757fb32fe5041a7f325cc8779fa5ba34a455ec2b9bbc10e3
-
C:\Users\Admin\AppData\Local\Temp\QkYS.exeFilesize
1.7MB
MD5715d2b8734fff82d00c7c65261153875
SHA16f3e8d19522d65706c30fb81be732b3edd136f46
SHA256455ed48bdb2f0ca2b8983c58a1b3e29b6ce0124c64f792fba32b1ae6f0a6c1b1
SHA5126213d6cd169c02250243b5d2d6ffe39b6e3555f8887fc99ae92add8cfa5c706a036970da64bb071fe6f8234a26166e76a36fd8af51f1861b4c6fe66ba99266b9
-
C:\Users\Admin\AppData\Local\Temp\QsAS.exeFilesize
596KB
MD5d660f35b43908d9b5ccd77233b36c195
SHA14724fe848fc516458b7eefad13a5d8d5e66b7c9e
SHA256b7af96551bbf5bca77fe3bc0df3a96bbae0ac2bc14a081b40d57c100c6c54f1b
SHA512eaf09bca7a7f5957bd378af190bd9f17e453e7d2c81621121668f48164875e156ed5199441289cabdf5c2aa359916f171f48ed17e3072a76e231b30a2d83bf97
-
C:\Users\Admin\AppData\Local\Temp\Qswy.exeFilesize
558KB
MD506495b846964eede83e762802e195431
SHA1a439ee3ce6a8e950d07e94c5f382a8a45777e4e3
SHA256ed13354c852b6b856f87895dd168b5f7ebed85079a42bc79fbd64b77b7eebd02
SHA512bf8960614a8b05e9a716b550fc208a7b1d2dd2ca8decd573c3506387adb5446612329b4b6dad815f72baade3a01a47d47a99a3886c64a565241e6bc768db547e
-
C:\Users\Admin\AppData\Local\Temp\QwkC.icoFilesize
4KB
MD5f31b7f660ecbc5e170657187cedd7942
SHA142f5efe966968c2b1f92fadd7c85863956014fb4
SHA256684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
SHA51262787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
-
C:\Users\Admin\AppData\Local\Temp\SAse.icoFilesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
C:\Users\Admin\AppData\Local\Temp\SMYA.exeFilesize
112KB
MD56e3b9aac1ac0e166c9318b5a3ce53090
SHA101f7719cae75cac67267a241cd2134d3bd77fe61
SHA256471123778bbd3b1f556892f567d950fdc9b1930a9ea7930e2041f643408571f9
SHA512baee08962ad15059b56e1c1069430297c3795cddb7023e7ac4099ec58e1e5f85ed0e58780adbb418ee909d6258ea25f921738e0b3211e81adb7e9325ca6bfbc6
-
C:\Users\Admin\AppData\Local\Temp\SoAQ.exeFilesize
112KB
MD511e8d7bf111669fc2fd6fbc35abe725c
SHA13d7c5743fd722ee907902c08b878d4b2ffafd46b
SHA256f850004695b7112758db66de096812ffd71f12d945f8c24fb7b76fd8c4ffbbd9
SHA5124fa74e4f97d30e1947c7f5d4a8fe44984ae97c6d2ba64ca551c237db963b884e5f02f781ce3fbcdbd140199baeb1d72466e3ee5dd90b9b17dfc2aad3c22f1c8c
-
C:\Users\Admin\AppData\Local\Temp\Swke.exeFilesize
111KB
MD5216589b602169adab1a82d6e3fdac5b1
SHA11ec36b5ea0e5555f291efabd552e020d32fb30e5
SHA25656b07b114860d8d06d35a67ca41caad2fc15f476a90ac7db42dd98196f9a182b
SHA5123d65413463781e1816d7b7398f63e302e5b2c1b676e182af6dee7999a1832e50194e5e755d81e10702bcd7ef87dfc9435658c53641ba4b39416ae9b5fd8c4845
-
C:\Users\Admin\AppData\Local\Temp\UckK.exeFilesize
112KB
MD546869e18f27958f8a85c260c94ce6926
SHA1c64fe42c52a22ae810299efd468ddd94e1339007
SHA25662040807f2f777b80acf323206e14912cf9ce73e3353ce4d51da72fbde7afae6
SHA512a05bbd9efc4b44342da3bc789af985f810ef8e54e3f5d2897edba525db78a1c188eaca88491605da00a7717012e45588b8e4a2aeda3f33cf19f21d69b74ec7eb
-
C:\Users\Admin\AppData\Local\Temp\UoQo.exeFilesize
111KB
MD5dd0a7c74af89f8c976dc43242b1d3b00
SHA14beb78b52ae54405f2b608c6aafddf659a912e42
SHA2560461408e5d3a88adeea5e4bd0e5140247e6991739f519e8cf0bd715d86864023
SHA51204ab035da7a14ee3e0eff3586d6fb3179a1a5f191578f632f01b848556f3ba28ce41287f504b0f5d26e2cad8c7992b5f1d329e52e9795b5daa89527c227ade31
-
C:\Users\Admin\AppData\Local\Temp\UsAO.exeFilesize
111KB
MD568b23f8db1d28200542d7b2a4f915fff
SHA120b2c638a5dcea51dbebe6951a5f1dbfacc8483c
SHA25651c7b2bee3ed7af9c8f4ab283aa27b96651d10ff23be54100f105ad6ce680887
SHA51230266bb3f0dac40e8984e716b1644ef1da8fb2e83b81e97e33a53c38c15c63dd3c76864fac4b2d677bd35c1a1e9b41ba620a002e1df3eb105e3ca04dc24e3e56
-
C:\Users\Admin\AppData\Local\Temp\WEIU.exeFilesize
110KB
MD554ee35c27a3a4e136e072b1e8ccf9f82
SHA1c1be087823b9fcd2603aa67075c34f075d6f9ed9
SHA25652e1945787c468e3dd63f4096ddbea53eb59ca5ba7b64807f1813d122fbac373
SHA5127a8ef1b2ee51b7ab3013e70d7736107d9ed331503b659c7d96ea12cfa2e8a4588c835928f220f4c004fd552871f5b87175d0d0a4f25c1a2eadc2431c9e62e824
-
C:\Users\Admin\AppData\Local\Temp\WEMU.exeFilesize
698KB
MD59ae710abfd6b39c1b29cb8c786adcd92
SHA15a6660409fb6fc369bb8e73fb4f98585aa26ded0
SHA256ee8063971410c0439ea5512a4aea7929b6bbc6f865a47857af473f00a5711982
SHA51267d6588dc2eb71cba4585858005af08f9bacfd0ca12041d77ae1e123360730f2ec0a002271ef57258b9117155ddb1873ee54429f90499ca68a60548872796e00
-
C:\Users\Admin\AppData\Local\Temp\WcYk.exeFilesize
112KB
MD51f3ecb39dcbe735896d322ed5e1ea513
SHA198f0e08333e1a37ff953fdd1e41253f62669a67f
SHA256bc9a10757ad22b30b250cce1e458d51c48234eb3128d88df3f5861f25588f02f
SHA5121c012c64c553ab2c5633332a5ec77f7b4d38b9e47fe2b0d9c33fa00d1d0e2029ba3e6274d1f1a22a3cc3a4c391b4643bd42592c0d796b0f631b4620a73bc34c8
-
C:\Users\Admin\AppData\Local\Temp\Wcoy.exeFilesize
697KB
MD51f74383e96fbcf433a5059476e46beb0
SHA1f92ba95dbe00d0293277c58086b15933fc9b0f63
SHA256966f6559035131885a3d6d7254e4f0fdc37c93b0086eb48bc4a0bb844b4110a9
SHA5124b9a114fb428f2ca054e0cf406804ea3c4c96a3367563c355b79c222c4c0229c532eb1be8dbc13b3bf3bf08546f3c1b19da536d9043a239fefe24d7accf4bfee
-
C:\Users\Admin\AppData\Local\Temp\YAIA.exeFilesize
112KB
MD58250dd364508b513d9cf7dea8315f355
SHA17c829a2256b3b2d70a58c6a0b5a0f2a9b4beee0b
SHA2564ebfc760c9de45a83bc7cde4b08f8adda883933094376b6ac7250f1b3a44e234
SHA512289b93eb1e78509ba5bc49715a42643d3e1dd39fc7a5d48bb8a99d66cf11d4ff913ebd2f489cd46d01a0983158d81a99a7d424bb212fd1637269d5097b7959c0
-
C:\Users\Admin\AppData\Local\Temp\YIYg.exeFilesize
554KB
MD554e183b114a71b70a31904c6834e9b3d
SHA1f034bd6744d39340c44d9f783612fd6a85abb8a3
SHA25694da86d55516a6ac0f9c65a06583f53034d8f59158f94d3e0f4b7f146e188a0b
SHA512a1103688363208c5e5f65d8121f24f515468b09bc4b56de70a8d2595714d0ce47ac52b2f42375872ec3150271cf4937e2e783d9671ca1735acdde6b9d48384d4
-
C:\Users\Admin\AppData\Local\Temp\YUIs.exeFilesize
109KB
MD5d2fb07cdc9bad5a47148475f7c1f5c89
SHA1a1f9c4c59c29649cae58f94c2f5ead60ea438022
SHA256a0566493ffb18eb2a6a717b4069c737785141abeec01faa165d064d38a499f54
SHA512c21dcf2bf9b691d40f6c4dc1a05801f2a1e004ee58271274273f6212e015ed5666cd72e135802b3ecc970d1c4c8b866dbdd95360703484ce2f83618dd4158505
-
C:\Users\Admin\AppData\Local\Temp\YgUw.exeFilesize
126KB
MD5c75eca0381084d9c3f191ac75e426c54
SHA1753eaccd5e21b1089426dbe66536c578cb6f20bb
SHA256c62694c7c9a1ee439176053085ebf1e3a9e37c982d25c67b0b719dfec3d0ab46
SHA512ba91f2694e8100af3f5b69bee4d03aa5ffb672568dff94bc4908d31828db0d5ba29a4249cd1d12a1405dcece1cee0c37c3b6998dedc693b21d42c0106826501b
-
C:\Users\Admin\AppData\Local\Temp\aEsc.exeFilesize
119KB
MD58d051e764cbb285692abe209f1103176
SHA1b1dcda5bbc97f993b56cc8d59d46f79b773cccd8
SHA2560f8d080bca62161fec6093e2568ed27b94b6356350a1ae9b1e6061fc145ff739
SHA51266072c9d35fd3d61351408b2ffd9873015af041808d7005fc044f64aa3d45fe53899838642b26ce60d33a733df6f76ce192c86fca00fedcdcbc3ea7c238a77cc
-
C:\Users\Admin\AppData\Local\Temp\akwq.exeFilesize
565KB
MD5a962a4c1c572b9ed4e882e27614d5661
SHA1a3118266ad7d7140c93f2b6e648e7b50791a91b5
SHA256237de9eed020ea8c104d54d8bfaaa0e4e889dba3f1045fc6f30687c384f0678e
SHA51226d9c3e50a586fd433b6756b65e9dc22d2ce13328aff92a46726445027626e5e992fbd8ebf5cc31b68789890bd77416093e33c2e7399774f61771038ed8a2ee4
-
C:\Users\Admin\AppData\Local\Temp\awMU.exeFilesize
691KB
MD58c64a72ad1ddb043b71af5a0e4e081ef
SHA1b5c8e51bf7026d98eb04690c3cf6778a567ba8a1
SHA256b3e41687f2e912859bec4b5fa04150aa81c116991505e36a43093f7150ffc6ba
SHA5125fcb761ab1087cef7f64afd6829e805034b97c89a22dc7817efe53db389346cd567ec9e2b42622ece1494e23279cb4411d3e4a06efe85474ba6b5a63a2b5155b
-
C:\Users\Admin\AppData\Local\Temp\cMEk.exeFilesize
114KB
MD54aa3c20338457af96aef20e19a646dca
SHA14fb7705ab64578f5b59317ce704508624b2b4fbf
SHA25638aeb0468587af983dab9df30d2b4e78fc9b94d7fa44074bdd6fc59e26e0a892
SHA512a5a7e36def2c124bc7ab5488f5e47d343ed2b1d7e9a38c7757239b40d9f5da63ebaea59528f62742d096ff96425ceca60010f130542ed842b44afa0f7ae703a4
-
C:\Users\Admin\AppData\Local\Temp\cYUs.exeFilesize
112KB
MD568b0af2535761aa3a612cdb4d1d55560
SHA1b40e2ac24e505619791be31d93022388ee8a4516
SHA25663a5d5cb1597d5e73432a3ef19cc84ce1d4f41a03f21248b7b08f16996f1dd82
SHA512a03a1fa423068045fb309b89e635a08d360bde15efda4b0aa554078328bec75b6444c8cdc4e7537ec0d2ad4ff0e5b67702fe15231559dcf5a47a70fcd0341f2f
-
C:\Users\Admin\AppData\Local\Temp\cYgi.exeFilesize
112KB
MD5b3d16842a12a78b045bd378c3a261e22
SHA18e9d6544995fd3383a86419471b2bc41bdf8fb50
SHA2562b4a023cb13f621759604c4e23ca2bc30bea3eeade0457ee818336e8f9e0bccd
SHA512ea9504752c5b1036ba90cadbaad00d05ab250d6fd6d18affcec6f823abecedab9fb057ea5ea546e6bb229340feb130eba2a454cb1983ecf706651ecc152b00b2
-
C:\Users\Admin\AppData\Local\Temp\ccAc.exeFilesize
120KB
MD596947f02c2d0645d7631000e9f08d42b
SHA1a8476223a6b4305c15e21c7aac8f63c46e428300
SHA256d9648df69a13f27b40af18fab74a4b0b2c89ef65c53198854af4eb42651687a3
SHA512a40a64af290eb36bf0197a66324a57526816f6772a8cbd1cfb5fac9c279d1570526a2bac365059eda75f0620958ccb427c7ed4185851b4cace8299ade23c2e84
-
C:\Users\Admin\AppData\Local\Temp\cswy.exeFilesize
112KB
MD5049236ca682d6f5fefe376c890f36bb3
SHA16e08b616e6e01b5edfe91c401a63d2b43f57f1ee
SHA25670ee7072d240cfb09ae46088929554d52177af4de54a12bde72c3b8bd9969235
SHA512a25512a71800f08b10c69afe8c444699815cb5d76ba430121f57eeb2cc38ec49a106c69b86a6b8783d0a93cd88fbe426c86cc24ee04d3b95109c235691a56365
-
C:\Users\Admin\AppData\Local\Temp\eAUI.exeFilesize
116KB
MD53d74b63d299fb6df26c24d371ae447fa
SHA1757c78651227c0dd4470670126a72d3d96ce77d1
SHA2564521882c5a7adccc9780c947122f257bda0dfa130c50e57b01af8fcae9768189
SHA51236a1b5a4b56c03ae08101212bb8d0796b34f3ec9ed0c8ef27f43209d5403919ce8cc5ec9dd854c2bfca9800805fb6e0e8de3dd2144e33d19d45a858b65130766
-
C:\Users\Admin\AppData\Local\Temp\eEcG.icoFilesize
4KB
MD5d07076334c046eb9c4fdf5ec067b2f99
SHA15d411403fed6aec47f892c4eaa1bafcde56c4ea9
SHA256a3bab202df49acbe84fbe663b6403ed3a44f5fc963fd99081e3f769db6cecc86
SHA5122315de6a3b973fdf0c4b4e88217cc5df6efac0c672525ea96d64abf1e6ea22d7f27a89828863c1546eec999e04c80c4177b440ad0505b218092c40cee0e2f2bd
-
C:\Users\Admin\AppData\Local\Temp\eQAC.exeFilesize
111KB
MD5147aef80731e6b6ef6890c9e3d606df3
SHA1bd585bd3f10c17f4cb68dbcc20dc5c17201d70d4
SHA256ebbac8b9c87e4c36c593120ec638e7aa611fc99fa22b31263fc1a14e827d5946
SHA512a4dc10f55229b5188074e46f9faf8800e61d1d43fb546f67384296c92d37c93cd9222bedda9da15251a60b5c865c8e646a2f45c72e79cc3cddd18d2ec40c4a8d
-
C:\Users\Admin\AppData\Local\Temp\eccu.exeFilesize
111KB
MD5b3baa834513eb70c378956e820ff9c59
SHA1fa603b326994a9593236c2ecc9b507a08af01860
SHA256af34ffaa3a154272ce4d2d6f6b171a140c8f9af7019aba065c6dba9bdc12424b
SHA512a84df53dc36901f9e557a1a4630a3318fdf7c2b3ea094285d74285190731c4bd748f952de7cd4ea18e9a8dd5a79126259a849c6d885e9731bb9650c0bd7301f9
-
C:\Users\Admin\AppData\Local\Temp\ewcg.exeFilesize
120KB
MD5f8b3b608af003bafebd85c9d997baf73
SHA1e92b21d1b28b6f079e01129afc92580795372112
SHA25636c3ff3d29fa6805aac459e88a41aa5dba8ffa4961d4c9d52572703ea689d4d6
SHA512fe0c24d01eb90433ffe782af1edfd26c09523d5a0a99014c4242dbbb3f7e6a3bbda7414493914c1ba6a1ebc4f40cf89c4b68587040069ec86824c96b077dbb45
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\gAgs.exeFilesize
701KB
MD5ae567706ad0684acfb99c5f1b7e7bb6f
SHA13fc6f177f8fa70ea89725f7972765066ce35dce1
SHA256b66f07fc46b7cd9498c63371b94c51bdfa7f3d3403706b78dedee540d3a9c7d5
SHA512cb407349b2e4969bc4db873f11aabbabcf876190dec5d988e2ecca224a6b2073bde6cb12de82aaedc942f66f50bb8abc2b568686e84bd8d3b940b9eb713dd718
-
C:\Users\Admin\AppData\Local\Temp\gMUY.exeFilesize
112KB
MD5985574186ed970667a72d8b9825a3d36
SHA1e9229bece28ab21c6d119903b5afbd5de1ea009d
SHA2567be930b4601bc09d6c9b5b0c343ce10ba9c87e268d49b50842f8f353c9febc63
SHA51242abe257f68ee45a21aa50e1c63219e3ac6bc6faf5c33b43741afd90a427a2b5ed17742d9e795f1fe13cb82c07ab7a327829590481ebe52b595de3f0c4e76e8f
-
C:\Users\Admin\AppData\Local\Temp\gQQe.exeFilesize
237KB
MD526f3fce34a4f95da12ed2b67b818dd1a
SHA1af0d448ad0502759a73d440140c04266593b8422
SHA256616b098f6d1d375dd64bf05ea4b0d6e675a807f7d5f65927b0b88787c625abac
SHA512ad212ad84069cf995c696bcfdd762f60c497fa66ab2c7140435c598aea2eb347cbbdb8682cdf2a95dcfb9fec2dc9fe04304813e1ccab52e7ddf046c266b6e8a9
-
C:\Users\Admin\AppData\Local\Temp\gUMO.exeFilesize
567KB
MD5cc6285b37a93db6b5cc79239bfb939d8
SHA16c709eeb64a2e7ea18c62c210a63d5b76ddeed8d
SHA25610fa9220987edddc47b2df7882f5da7cd93b2424a96586f2448b3368d4b21c16
SHA512e0b66a355ed0b980f39bb976fe48b5703d8b386200b1850d7ec0463c57f741e5b3ddb0fc1c8ea0ae318d73030dedb3f7d39786e2980f0eaedc5c63801611d23a
-
C:\Users\Admin\AppData\Local\Temp\gUcG.exeFilesize
112KB
MD596561fbf8c23c97b00f62d1fc53a5d18
SHA1f8f48ba5b302cd6ace5a3e88a23cbf1465ae0d51
SHA2561547e5de8bb9dda915796ccaee5f59bee18d94e120c122010cd865e47105f1c6
SHA5123335bc13aee1f9e4d2a803b352a34cb05f9cfb038f7da17fee21f099732873425880e7c7b56c023de449808d5f324a1278427e7700c457c4e94494a89dbf5979
-
C:\Users\Admin\AppData\Local\Temp\gcUO.exeFilesize
112KB
MD563c774436da59da28d847d247972d2fe
SHA1a08a1639e3bb4000c35eb202ac59b46f19c345d0
SHA25698c2958ea19702ae23df9dde277406271a009087dc00e68637d1ccff7fd3ceea
SHA5126fc286415d131c87ab0b5377b6676b7aa704c9abadab82dbbcd853eb83d26c1a20e4fa52e1ca95c52328a1837ebeb926051fc40853fec1310e343945a9f88fed
-
C:\Users\Admin\AppData\Local\Temp\iQYa.exeFilesize
114KB
MD5ecbb5e587faf0513f49ba9206d2e5d32
SHA18d15312bbfe5a3187803e781caa10bfa79691707
SHA256a9f547a7a477133d46191fb27f03a9c873e549fe4ac94d431a69ca992223e343
SHA5122a6b18b7bbf585e3815de0e14e34bc170ffc700b48bd41ba747ee419ec431f408ce17ee09730c6a4d7001d9ae4ab10eab04fcab6a6a0631d96c9f3a5ca4b30ab
-
C:\Users\Admin\AppData\Local\Temp\ioIu.exeFilesize
139KB
MD5e31db2cf6208c349de170b28f84f4c28
SHA16c06795bb9e42eaad77c189028494554d8d6ef8b
SHA256bc18cacce5a3445a6e71400a3ecd5f48eea4c46271efd5cc288ffbb9f6124101
SHA512de2cf1f2aac8f3c6ec05298138d848697b70cf763813e006714c0f3231d50932c33521237123bf64875f2f9792678bca8320ac8b5a155ca53342dd3b72b83f5c
-
C:\Users\Admin\AppData\Local\Temp\isYk.exeFilesize
806KB
MD50f446d4097d024d9a58ed8d65a55c1b4
SHA1c21dc845e480f94849025c37c50705bb9c10ad0c
SHA25630b05d32388231397f07f12b3d260ca3a67c957c65dc84355b3427bc66622860
SHA51210104da2a8816ae15cb581f100c160553e324a4f821d671f1d6a92190c0002d31403f09c84ea53f0b328d5f4baf4b52cc9479475444fcca00a1f7a989715d85b
-
C:\Users\Admin\AppData\Local\Temp\kQUG.exeFilesize
110KB
MD533a5e52e7ef9bf210771a3c19375aaba
SHA11817b8c5f56081e1ee085f3eb92bffa8e7bcdd90
SHA256d393f1bbfd9d096aa202f6e26f6de618ff6bf720030c1c1a9d25c9618bd15fbc
SHA5128e372b81f0e50fbb4684092e912c94d00aca8c36dd3625935bf6ba7d13c4ca8e34aad5f4d2de1de1dcf3758465cf803c27df05e606dd49ec15b1088ddea7749d
-
C:\Users\Admin\AppData\Local\Temp\kQsg.exeFilesize
484KB
MD5ac2185d5d9c1cbcdee63aa182b30f549
SHA1da20a6b8785124e3e74d27e0bcca1fe6a9eb4555
SHA256868da87bb348c023862fc82154a357973f5cbdd2b2b28b01bb06ea6df58e6e6d
SHA512f97876ed0e3c7b9c3333cd4c802313251cfdad201785b9e49f7edc1f632ff4eb2f5c25a21ef647452d12d37bbd3aa20ef75299d65821f6efa2e1ef3ccf97a733
-
C:\Users\Admin\AppData\Local\Temp\mQIk.exeFilesize
139KB
MD51128c4d0f505c7efec1eebde7786daa7
SHA15125129994eab74f497353d9d2b638be6c71d2e8
SHA256c3ae43755bbb0019d66aa0f76304293a7229498186151783ae109c34b1b33da4
SHA512f05fb9e15f964b3f707e7e6c5ddd42af1952b35cf414e384b39069f83e8be11c22874f71ac3952199b776fd246bd3ad01b6ca28c2cd5508e8e89ac1007d9f2fd
-
C:\Users\Admin\AppData\Local\Temp\oAYm.exeFilesize
112KB
MD5bc000c2dd4d586b24c3d504049d2a62f
SHA1fa75173c397139775116a690348be91bf3fbdde3
SHA25647e5421c702157fbbd00634a9cb007c36e168a7050ea14b9d11e18b7142a983a
SHA5122702ad7c0d3943bcfafc7eed7ea374186de10d21df1aa73f4dfb996363154abf3089da86f38de516b41f0217a0a6cb835e5ba42b7a872167aa00bf2c8f570a4f
-
C:\Users\Admin\AppData\Local\Temp\oUIg.exeFilesize
111KB
MD5dccc9bf7c0ea44daa1f4e849c673ae76
SHA147a221cce75b4a56b4980710c625b080b09198e3
SHA256f5f5bd9d51ac6f4c1fd00133035e942a96ca95718a440a697bcb57261972fba9
SHA512ddf1290879a2310ecb450bd960edfdf06ee7b39bf7794492c37140db4f35319071df0026ef76401600e403f682401b9476111b935712aa5b5e222c04df41b6af
-
C:\Users\Admin\AppData\Local\Temp\oacgEkEs.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\sMYs.exeFilesize
236KB
MD5d040fdf7f5a44dcc8d21479c3b7d5121
SHA16bc24324c97cddf35496d9911d6114d1fe78e95b
SHA256351833fa174f3df9fedbb2f89a0eede085462f24723a3f22ae8481d050ef2051
SHA512ea26a8558a6dbe7eb80110cffbffa7c7c85ec0f76a4377ac084a54b9f2f6044067d2417dd1047643b1d07c912aa586d6dd59ed9d89c02595b5ff94c8e1c291f3
-
C:\Users\Admin\AppData\Local\Temp\sMki.exeFilesize
115KB
MD5594e7aaf3655bdf012183b2a15251e2a
SHA18d9f7bd532529da612cb52353ceb4fad63d853ec
SHA25601b556d5d0abf1cb1c2c96d0cfd78f1f499461203a41013e09e77fcba80b834b
SHA51219ca966bddf58ecfe6cd2b7302562d8f504668ee262b8ddee5e875507fc76eee1171a0c8e956820f3d74993bfedb9cafda8f5f7d466471eebcbb776c6957758f
-
C:\Users\Admin\AppData\Local\Temp\sYkY.exeFilesize
149KB
MD562939f13460e472122403dd8a9383612
SHA19ad6a562db2cd5ba7724eaf2e44f6c7d0cb8a8b6
SHA256f758301dbc53780693f0365c15029aca83edca5101de79d23bea496c912cad25
SHA512e6f2c405be48159bed476f88afc6a5a73e44b5c58e5e934d049d18a3e08920b250dbac3333a57eb9da543bfab3510da0af9ebacb34185b63a843b83faca6b316
-
C:\Users\Admin\AppData\Local\Temp\uEAc.exeFilesize
111KB
MD5d9b3f22c370747eb5c31ce8bfb3d2bd2
SHA1ef4e369da06a135d029c591d8f1fef3d38feb217
SHA256f1531854e3846546faeb6784fc3d95a2767bbdb3887cc5adbcd4990ec4cefd1b
SHA512d146af174bbcbdbafdc5c07bb01381d3b172c5aaecfb887d5d8e19094ff2025ec7d7754ade8024b80c013a6aa09afc35e10a9905fe3fb859fe3f32aa6ef220b3
-
C:\Users\Admin\AppData\Local\Temp\uQgO.exeFilesize
138KB
MD58008213e958d730b9d2e963bbcfb0dfd
SHA1ec39cf052ef3d287a967183f36b4b63ff86fd683
SHA256a46ec1134b567ca42408653dd80d80ea02ba6201259112f628df28e9e852f3c6
SHA512ea88f5eeab9be058b4a71659c694a5e83f7caef57d45ecbc31eb95d498a06d632d98b689580dcc23e50f842e73ab0ae8f480db2b5280dea4eab5b2cfbafe47f7
-
C:\Users\Admin\AppData\Local\Temp\uQoi.exeFilesize
119KB
MD586dd942ec08844ff8aec7d19538c2c98
SHA1f05c81d7a11f519f98c3f9e15d917c9943e5ad49
SHA256ad4eaf8556fa2365d0a549aabf11c4de76dd4af20c72652c14fe950710ceca53
SHA51296a9ef2723b732c80e36bd9cafda085b1e5bea079a7ff9c5d56663cba41fd7676bcce510d7a29f78233218a0a327f47f095675be1080ddccf211f0a22b0065be
-
C:\Users\Admin\AppData\Local\Temp\uYgy.exeFilesize
114KB
MD5f446bd1834908b2eb3c2e73a1c4f7b99
SHA148ce9c861f58daa80d14c169bbbfaa57fdd83266
SHA256ca30a5064f91960ef64d3e368fecb613531ce6f522f14d7da14565a4f0129e79
SHA5124aaa181289adc4ea89c61cec19ad1072251d6b03052858784d11257dbe92465e56cdcbad98249fdca67a0c2b7e39c41a8d92bbc5e26356ad5e83d910253624d5
-
C:\Users\Admin\AppData\Local\Temp\wAUo.exeFilesize
5.8MB
MD58b30811402f927549e08e8fa92a86569
SHA1b348297742145d8fdf7ac3437d9b666053a992e2
SHA256ab7656227f7dfe96d380503b779642a701b9a75348100d26e82e5dc4cfcd9d5b
SHA51274b9ea2ca91159cc981969f9d1cc240405beac76035ee6ee9387dc5f622343c52e34a1e23aaff471e8196d1080f12cfe1aad0a70e0e9dddbe78beb45ea233cb4
-
C:\Users\Admin\AppData\Local\Temp\wEUm.exeFilesize
113KB
MD51190a11de99f1d3d4d0413bf94877ce1
SHA1e8c7f74328e45c45b4728f420d2a1c30e30651b5
SHA25622ea5a73b410973222cd88aedff1240b4a4d4f14885767628ea9cb603e5a45e5
SHA5125188367fdcd59b71f1c526caa1fe8a355dcbde3c33007929b24a56d1d76f58e71aee638b3e14e45e7ef33042ab01c11a6aae15c66d4f7453c47fa27926e9a8a6
-
C:\Users\Admin\AppData\Local\Temp\wUAC.exeFilesize
120KB
MD5403fb432d0d9ac3090e344e6b7666841
SHA1b1a0df7b19cb9632110ab1065761baf23d4af5af
SHA2560cff808443f4def145bab2a3f610b32db70f73f11e82332cbec59a68fd0312b6
SHA5124cccd93eb759ca662322bd41adc23e0daedddb5428aa0c0a60e55806a65a1a73ac5d4f6afda48387ca46b905d034fbc2c89080c36c6e360bb1084bfd3fa4e53f
-
C:\Users\Admin\AppData\Local\Temp\wUIS.exeFilesize
143KB
MD5c9a1818953f283ee81a7248f4510a764
SHA1a8517e40bf3162fe8dede3e2371c1e7b13c365c2
SHA256e46c99c72e71343a02c83aa51190e82f1c8727f4d3383b743a56fb930d835c45
SHA5127fd01574f1e254775188a69142c16a9c7637513334424cb7e12bc5dbb01bc278afc865f7f8521658fd94ccbe349f0094a1f0020a57799c5e2c0b292c49289349
-
C:\Users\Admin\AppData\Local\Temp\wUgA.exeFilesize
115KB
MD5a07294893fd9de0c29faa77ebfc32bec
SHA14a7ec33c3804d0165053aff67aa9005e24df2b7e
SHA256c85ed106f98667c62e462ac76b846f00f4e10be8e2766e2e90c00bc630045015
SHA5127558648fea4aadf02a6175a4b51c00aa67ca90a1d014e5414ddbf241906a9815518a97c012dc590d27a55bdb670543e1334948361d7e43446d7055b736042026
-
C:\Users\Admin\AppData\Local\Temp\wYks.exeFilesize
112KB
MD5d0908b7d181c7ae94533009c96b3c2a8
SHA1ab0f9904e1430b6f3823b1147feeb41f5327253e
SHA256b520cf95dfc0b467ef833b0718736487adeeb913d371f55ea8b665f8687c5f41
SHA512f264be00781ccf45a38f7056594f69526d7dada8954ad92609a58f1319ee5f16de0bb4193e10608054d4649fbfd2ebe4bb598a7b92b28c44df929a37bb9c51dd
-
C:\Users\Admin\AppData\Local\Temp\wcwy.exeFilesize
112KB
MD5584eb40acabfbb34a0c716613c7f017b
SHA1a0a038f06ca178b812b04470f7deba44e85d1389
SHA256b8db61d431acdd43f3d589fae4b0c7fd48eb00cc37c8f674ee030e684244bd74
SHA5122bffba76c0689779bae5b3445988e99ab19a4ee4556c40f132b927e6ae1fc6b2e3c79e18d9af81f9de05f50f358b2ac8104603953c0ea7e570864c7723f915a6
-
C:\Users\Admin\AppData\Local\Temp\wwks.exeFilesize
113KB
MD5c7362aa7d092fddddef525a84c22dac1
SHA19e70f8f7ef8c355a7f14fb5f42896668dbe74763
SHA256a98b54027aae0d0d1e5694a394dbaedbde19670f3a0bbcb10a8db155e1ad3169
SHA5120c9b7bba0e77f2fce1f70b7faa886fc160447af291cdb943490cb14d1407ac3903bac2f88ee09150110e102f7fffd1111eae297a91c0d62ed42dea18f5a08b4e
-
C:\Users\Admin\AppData\Local\Temp\yQYq.exeFilesize
110KB
MD5cfeef3349fa5462f533a3e715e32bcf4
SHA1b1c325c82cac2c6ce28ba4d87b2fb40dd32b4544
SHA2564e7db99524d5877dcff9c51c64a148e9810a6aa8c3367518f00d33d59c1b2dd2
SHA512fec222be051a5b2300397e204267b0aef7c7d4da6e105eaab8664d86e0d9db81ee9d368b633744310844bd7dcd7176d60b8a59c07226454fdd2102e0e157f6bd
-
C:\Users\Admin\AppData\Local\Temp\ykIy.exeFilesize
116KB
MD5781916203742e2e980ded88fd09ef59d
SHA1bd89a7414a9521c5f7ca3eb05197ec2534c53777
SHA256d73dfc04d6aeb4339a78f0f7580301800b9322bf9d79ea4e2e8327719e4a4d02
SHA512cbaee0421358fb1b4372e2deda8ad138827f9442b42e7233bd436ed3169a2f654c89a67467257853794509f657a264ed10429999aa0cb61005efbb610ea60f84
-
C:\Users\Admin\AppData\Local\Temp\ywIe.exeFilesize
970KB
MD59e360d79683c6dccbacd7b76ee067662
SHA1a00792c2e7c5cdf42a53864f54514041893a50b8
SHA256116af98d85f469816ddf59dcc37624a80bc2f88028db948d86aa240783c59de1
SHA5120d28ab60e9d4eb677b595698e4de33ac9180bfb7ad4fa9a7fb16bd464e56e206d43959e39d4d52a7db435812c219c34bf57a02094c972b5e73e8b723735e89d4
-
C:\Users\Admin\TKgYUgEI\jYAgUUsU.exeFilesize
110KB
MD515e8198b017c53e3c5acfdfc1a74ef57
SHA1227e63aac719a9cb5eb75290d6cf2371275a9cae
SHA25600feb786b7aec906682cc9cab1a851eb56592d39967227d589d7e5b360298bb6
SHA512ca547f49c4bbdc9bf670d38e473da8286ea63e463ac924efe60ad152ad85d4f913b8b80bb53f74fe416731870bb85c4b9f85670ea1466f5dbb444fd61af7accc
-
memory/224-392-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/224-404-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/368-300-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/396-210-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/396-195-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/400-457-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/448-258-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/448-242-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1076-528-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1076-520-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1688-162-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1688-146-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1736-357-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1736-370-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1824-219-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1824-234-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1876-348-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1876-361-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1920-138-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2444-88-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2444-421-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2444-103-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2464-507-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2464-519-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2472-198-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2472-182-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2632-56-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2632-41-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2668-423-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2668-430-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2768-413-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2768-405-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3012-222-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3012-206-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3024-67-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3024-55-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3076-511-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3076-498-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3144-292-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3252-246-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3252-230-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3280-492-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3280-480-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3332-467-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3332-474-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3416-8-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3476-502-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3476-493-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3488-284-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3488-272-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3492-305-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3492-318-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3524-79-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3560-314-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3560-326-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3572-14-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3656-475-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3656-484-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3676-309-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3820-448-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3820-436-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3900-335-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3908-453-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3908-465-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3912-254-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3912-267-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3944-375-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3944-387-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4044-19-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4044-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4052-32-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4052-20-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4136-431-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4136-440-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4340-150-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4340-134-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4560-75-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4560-91-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4680-343-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4680-331-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4700-366-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4700-379-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4844-396-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4852-99-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4852-115-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4908-111-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4908-126-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4912-158-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4912-174-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4940-31-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4940-44-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4992-170-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4992-186-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/5032-276-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/5032-263-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/5056-352-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
