Analysis
-
max time kernel
89s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe
-
Size
131KB
-
MD5
c055414e00cb301e35740f3591df4ea4
-
SHA1
e221f5b1ac929c2c04a1fb9e27c6e43d030a0fbb
-
SHA256
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa
-
SHA512
b7be9688a8d6ffa02b67948d4b5b2749396e26a2893ff736ea707c10ad15d8a0314b9d3dfcb1383e50e33c3d82f2e4f72afba2d6e1a3f4ec6e087ac02241ac12
-
SSDEEP
3072:1uxMFsg7SYqAnWAu95iwtLVymzq1MOggzR557/PTShlllllllYPA7Ra3Z:5lSYup9nLomzq1MOggzNPT7PKa3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
Processes:
flow pid process 152 5048 153 5048 -
Executes dropped EXE 2 IoCs
Processes:
eGMMYwcE.exeOKYoEAsY.exepid process 1928 eGMMYwcE.exe 4924 OKYoEAsY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeeGMMYwcE.exeOKYoEAsY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eGMMYwcE.exe = "C:\\Users\\Admin\\hekQckkc\\eGMMYwcE.exe" 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OKYoEAsY.exe = "C:\\ProgramData\\cUwcYAkU\\OKYoEAsY.exe" 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eGMMYwcE.exe = "C:\\Users\\Admin\\hekQckkc\\eGMMYwcE.exe" eGMMYwcE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OKYoEAsY.exe = "C:\\ProgramData\\cUwcYAkU\\OKYoEAsY.exe" OKYoEAsY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3676 reg.exe 3768 1888 3088 2012 3868 116 1420 4884 1888 2508 2100 1456 4352 364 5108 reg.exe 2264 3772 1876 reg.exe 964 reg.exe 3852 4012 3292 reg.exe 1420 3088 2380 1528 2756 452 4432 3016 2956 2440 4020 reg.exe 1932 1804 3868 4900 reg.exe 1848 3020 2440 reg.exe 3620 1484 920 3168 824 3852 4532 4296 2108 2428 964 reg.exe 3772 1060 reg.exe 4168 4448 3580 4916 reg.exe 4212 reg.exe 3068 2472 1876 reg.exe 2412 reg.exe 3856 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exepid process 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3800 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3800 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3800 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3800 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2932 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2932 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2932 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2932 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2004 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2004 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2004 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2004 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1952 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1952 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1952 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1952 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3036 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3036 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3036 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3036 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1492 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1492 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1492 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1492 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2656 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2656 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2656 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 2656 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 5032 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 5032 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 5032 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 5032 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3292 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3292 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3292 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3292 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4172 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4172 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4172 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 4172 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3708 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3708 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3708 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 3708 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1516 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1516 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1516 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe 1516 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.execmd.execmd.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.execmd.execmd.exe2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.execmd.exedescription pid process target process PID 3688 wrote to memory of 1928 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe eGMMYwcE.exe PID 3688 wrote to memory of 1928 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe eGMMYwcE.exe PID 3688 wrote to memory of 1928 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe eGMMYwcE.exe PID 3688 wrote to memory of 4924 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe OKYoEAsY.exe PID 3688 wrote to memory of 4924 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe OKYoEAsY.exe PID 3688 wrote to memory of 4924 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe OKYoEAsY.exe PID 3688 wrote to memory of 2236 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 2236 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 2236 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 2236 wrote to memory of 4660 2236 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 2236 wrote to memory of 4660 2236 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 2236 wrote to memory of 4660 2236 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 3688 wrote to memory of 2604 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 2604 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 2604 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 3016 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 3016 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 3016 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 4296 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 4296 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 4296 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 3688 wrote to memory of 2656 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 2656 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3688 wrote to memory of 2656 3688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 2656 wrote to memory of 820 2656 cmd.exe cscript.exe PID 2656 wrote to memory of 820 2656 cmd.exe cscript.exe PID 2656 wrote to memory of 820 2656 cmd.exe cscript.exe PID 4660 wrote to memory of 3352 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4660 wrote to memory of 3352 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4660 wrote to memory of 3352 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 3352 wrote to memory of 4688 3352 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 3352 wrote to memory of 4688 3352 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 3352 wrote to memory of 4688 3352 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 4660 wrote to memory of 572 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 572 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 572 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 3060 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 3060 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 3060 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 4900 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 4900 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 4900 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4660 wrote to memory of 2592 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4660 wrote to memory of 2592 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4660 wrote to memory of 2592 4660 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 2592 wrote to memory of 364 2592 cmd.exe cscript.exe PID 2592 wrote to memory of 364 2592 cmd.exe cscript.exe PID 2592 wrote to memory of 364 2592 cmd.exe cscript.exe PID 4688 wrote to memory of 4636 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4688 wrote to memory of 4636 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4688 wrote to memory of 4636 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe PID 4636 wrote to memory of 3800 4636 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 4636 wrote to memory of 3800 4636 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 4636 wrote to memory of 3800 4636 cmd.exe 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe PID 4688 wrote to memory of 1892 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 1892 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 1892 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 3276 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 3276 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 3276 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 1036 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 1036 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 1036 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe reg.exe PID 4688 wrote to memory of 5096 4688 2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\hekQckkc\eGMMYwcE.exe"C:\Users\Admin\hekQckkc\eGMMYwcE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\cUwcYAkU\OKYoEAsY.exe"C:\ProgramData\cUwcYAkU\OKYoEAsY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"224⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_c055414e00cb301e35740f3591df4ea4_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵