Analysis
-
max time kernel
150s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
-
Size
193KB
-
MD5
3414b9dab576b04b3d434d024814b37b
-
SHA1
58af35de5df404d5fb254fc6bb12b593ce1a53c8
-
SHA256
fe624bc3ace0ff8a497e2b811b49d7e4cde3c5ca267b71843725d741d9747824
-
SHA512
4f62139ad922da2e23cd313b0d7bdc25b201d72b1d036a2c1f95c9cb0c5767d5c18f5ad48b2668fe7470fd40c63f26ca6bf3fa268581206f7ae3b1ac5a131a57
-
SSDEEP
3072:0sNHrBhbzwGj9vTj9+M9G3S7V4hL8H6X8OUs0DHAa1ApZbNa+Z:0sNLnbzwG9j/9zV4lGOgga1ApZ5B
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LIMIgAYc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation LIMIgAYc.exe -
Executes dropped EXE 2 IoCs
Processes:
EEEkkYYY.exeLIMIgAYc.exepid process 4032 EEEkkYYY.exe 1920 LIMIgAYc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
EEEkkYYY.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeLIMIgAYc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EEEkkYYY.exe = "C:\\Users\\Admin\\JUkgAUcQ\\EEEkkYYY.exe" EEEkkYYY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EEEkkYYY.exe = "C:\\Users\\Admin\\JUkgAUcQ\\EEEkkYYY.exe" 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIMIgAYc.exe = "C:\\ProgramData\\moIwMgwE\\LIMIgAYc.exe" 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIMIgAYc.exe = "C:\\ProgramData\\moIwMgwE\\LIMIgAYc.exe" LIMIgAYc.exe -
Drops file in System32 directory 2 IoCs
Processes:
LIMIgAYc.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe LIMIgAYc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe LIMIgAYc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1792 reg.exe 1144 reg.exe 2512 reg.exe 4512 reg.exe 4584 reg.exe 3712 4944 reg.exe 732 reg.exe 2952 reg.exe 464 reg.exe 4344 reg.exe 448 reg.exe 1680 reg.exe 4024 reg.exe 2260 reg.exe 4912 reg.exe 964 reg.exe 1240 reg.exe 4452 reg.exe 4208 3660 reg.exe 4388 reg.exe 2536 reg.exe 4720 1820 reg.exe 2952 reg.exe 4632 reg.exe 4388 208 reg.exe 4036 reg.exe 3164 2404 reg.exe 3056 reg.exe 2040 reg.exe 2308 reg.exe 4208 reg.exe 2112 5036 556 reg.exe 2544 reg.exe 3228 reg.exe 2140 reg.exe 1472 reg.exe 4848 reg.exe 4016 reg.exe 3744 reg.exe 1892 reg.exe 4284 reg.exe 3968 reg.exe 2016 reg.exe 1468 840 reg.exe 3216 reg.exe 3832 reg.exe 3284 reg.exe 3700 reg.exe 5016 reg.exe 5072 reg.exe 1052 reg.exe 2768 reg.exe 2836 4720 reg.exe 3812 reg.exe 1028 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exepid process 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4508 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4508 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4508 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4508 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 452 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 452 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 452 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 452 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4588 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4588 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4588 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4588 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1324 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1324 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1324 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1324 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3368 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3368 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3368 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3368 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3988 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3988 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3988 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3988 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4684 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4684 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4684 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4684 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2528 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2528 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2528 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2528 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 468 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 468 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 468 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 468 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3060 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3060 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3060 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3060 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2012 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4372 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4372 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4372 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 4372 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
LIMIgAYc.exepid process 1920 LIMIgAYc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
LIMIgAYc.exepid process 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe 1920 LIMIgAYc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.execmd.execmd.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.execmd.execmd.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.execmd.exedescription pid process target process PID 3212 wrote to memory of 4032 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe EEEkkYYY.exe PID 3212 wrote to memory of 4032 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe EEEkkYYY.exe PID 3212 wrote to memory of 4032 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe EEEkkYYY.exe PID 3212 wrote to memory of 1920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe LIMIgAYc.exe PID 3212 wrote to memory of 1920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe LIMIgAYc.exe PID 3212 wrote to memory of 1920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe LIMIgAYc.exe PID 3212 wrote to memory of 2920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3212 wrote to memory of 2920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3212 wrote to memory of 2920 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3212 wrote to memory of 4324 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 4324 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 4324 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 3832 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 3832 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 3832 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 1020 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 1020 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 1020 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3212 wrote to memory of 652 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3212 wrote to memory of 652 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3212 wrote to memory of 652 3212 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2920 wrote to memory of 5076 2920 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2920 wrote to memory of 5076 2920 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2920 wrote to memory of 5076 2920 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 652 wrote to memory of 1464 652 cmd.exe cscript.exe PID 652 wrote to memory of 1464 652 cmd.exe cscript.exe PID 652 wrote to memory of 1464 652 cmd.exe cscript.exe PID 5076 wrote to memory of 1472 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 5076 wrote to memory of 1472 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 5076 wrote to memory of 1472 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 1472 wrote to memory of 3836 1472 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1472 wrote to memory of 3836 1472 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1472 wrote to memory of 3836 1472 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 5076 wrote to memory of 2628 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 2628 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 2628 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 3552 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 3552 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 3552 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 4416 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 4416 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 4416 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 5076 wrote to memory of 4796 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 5076 wrote to memory of 4796 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 5076 wrote to memory of 4796 5076 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 4796 wrote to memory of 1680 4796 cmd.exe cscript.exe PID 4796 wrote to memory of 1680 4796 cmd.exe cscript.exe PID 4796 wrote to memory of 1680 4796 cmd.exe cscript.exe PID 3836 wrote to memory of 1360 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3836 wrote to memory of 1360 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 3836 wrote to memory of 1360 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 1360 wrote to memory of 4508 1360 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1360 wrote to memory of 4508 1360 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1360 wrote to memory of 4508 1360 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 3836 wrote to memory of 4688 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4688 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4688 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4036 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4036 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4036 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4092 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4092 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 4092 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 3836 wrote to memory of 1656 3836 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\JUkgAUcQ\EEEkkYYY.exe"C:\Users\Admin\JUkgAUcQ\EEEkkYYY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\moIwMgwE\LIMIgAYc.exe"C:\ProgramData\moIwMgwE\LIMIgAYc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"130⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵