Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
-
Size
206KB
-
MD5
10651c37469a05dca5c5dd5ad3b7c830
-
SHA1
8d629731228658bc85fe8110992a3befcb772130
-
SHA256
1d96ce6eef0d47ba0dd3b0d7205ba1ab16533cdab176ea9ca81d8d7807ae6a6c
-
SHA512
55bf0ead82a8942fdd7e7ee1a51a0ff5cf4e0e187e0fed2465a429ea3d6917099469d56d22ad125bbb71dd2880f3dd82ade40c64559b2a70eb729dd595bef24b
-
SSDEEP
3072:wbCFEsbDdXH6N7UZVPuT9RRNfJ0WQDdsWJqO4Y41KgDbrzvDLtI:ZSUKyVc8d/JqH7sgvDLy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 1 IoCs
Processes:
flow pid process 35 1164 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eOkwwIUk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation eOkwwIUk.exe -
Executes dropped EXE 2 IoCs
Processes:
eOkwwIUk.exerwIgIAIY.exepid process 2596 eOkwwIUk.exe 1920 rwIgIAIY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeeOkwwIUk.exerwIgIAIY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eOkwwIUk.exe = "C:\\Users\\Admin\\JqwMooIQ\\eOkwwIUk.exe" 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rwIgIAIY.exe = "C:\\ProgramData\\iuUMgAQw\\rwIgIAIY.exe" 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eOkwwIUk.exe = "C:\\Users\\Admin\\JqwMooIQ\\eOkwwIUk.exe" eOkwwIUk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rwIgIAIY.exe = "C:\\ProgramData\\iuUMgAQw\\rwIgIAIY.exe" rwIgIAIY.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CmIUIwwM.exe = "C:\\Users\\Admin\\EYUoQsEs\\CmIUIwwM.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JIUwMcog.exe = "C:\\ProgramData\\ioYYEkoI\\JIUwMcog.exe" -
Drops file in System32 directory 2 IoCs
Processes:
eOkwwIUk.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe eOkwwIUk.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe eOkwwIUk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
pid pid_target process target process 1660 1952 4040 1108 -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 5100 reg.exe 3724 reg.exe 1160 reg.exe 3788 reg.exe 4820 reg.exe 4608 3112 reg.exe 1668 reg.exe 2716 reg.exe 4420 reg.exe 1660 reg.exe 4300 reg.exe 3236 reg.exe 1716 reg.exe 964 reg.exe 4412 reg.exe 2056 reg.exe 1640 4300 reg.exe 400 4908 1204 reg.exe 1216 reg.exe 3100 reg.exe 3692 reg.exe 4420 4852 reg.exe 2712 2840 4516 reg.exe 2500 reg.exe 2164 reg.exe 2520 reg.exe 2528 2432 reg.exe 2736 reg.exe 1792 reg.exe 4956 4804 reg.exe 2368 reg.exe 4380 reg.exe 876 reg.exe 4000 3688 4576 reg.exe 1612 reg.exe 1664 reg.exe 4636 reg.exe 1048 reg.exe 2496 reg.exe 4836 reg.exe 4712 reg.exe 1484 reg.exe 1528 reg.exe 1028 reg.exe 1848 reg.exe 2100 reg.exe 3836 reg.exe 4712 740 reg.exe 4908 reg.exe 1828 reg.exe 2516 reg.exe 1548 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exepid process 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3100 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3100 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3100 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3100 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2516 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2516 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2516 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2516 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2056 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2056 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2056 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2056 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4300 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4300 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4300 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4300 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3324 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3324 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3324 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3324 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1852 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1852 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1852 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1852 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2164 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2164 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2164 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2164 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2868 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2868 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2868 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2868 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3428 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3428 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3428 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3428 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4456 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4456 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4456 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 4456 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2904 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2904 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2904 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2904 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2584 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2584 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2584 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2584 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
eOkwwIUk.exepid process 2596 eOkwwIUk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
eOkwwIUk.exepid process 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe 2596 eOkwwIUk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.execmd.execmd.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.execmd.execmd.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.execmd.exedescription pid process target process PID 3920 wrote to memory of 2596 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe eOkwwIUk.exe PID 3920 wrote to memory of 2596 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe eOkwwIUk.exe PID 3920 wrote to memory of 2596 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe eOkwwIUk.exe PID 3920 wrote to memory of 1920 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe rwIgIAIY.exe PID 3920 wrote to memory of 1920 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe rwIgIAIY.exe PID 3920 wrote to memory of 1920 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe rwIgIAIY.exe PID 3920 wrote to memory of 4580 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 3920 wrote to memory of 4580 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 3920 wrote to memory of 4580 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 4580 wrote to memory of 336 4580 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 4580 wrote to memory of 336 4580 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 4580 wrote to memory of 336 4580 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 3920 wrote to memory of 2800 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2800 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2800 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2064 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2064 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2064 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2436 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2436 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2436 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 3920 wrote to memory of 2164 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 3920 wrote to memory of 2164 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 3920 wrote to memory of 2164 3920 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2164 wrote to memory of 1180 2164 cmd.exe cscript.exe PID 2164 wrote to memory of 1180 2164 cmd.exe cscript.exe PID 2164 wrote to memory of 1180 2164 cmd.exe cscript.exe PID 336 wrote to memory of 2660 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 336 wrote to memory of 2660 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 336 wrote to memory of 2660 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2660 wrote to memory of 4404 2660 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2660 wrote to memory of 4404 2660 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2660 wrote to memory of 4404 2660 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 336 wrote to memory of 3112 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 3112 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 3112 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 3968 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 3968 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 3968 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 724 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 724 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 724 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 336 wrote to memory of 1760 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 336 wrote to memory of 1760 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 336 wrote to memory of 1760 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1760 wrote to memory of 432 1760 cmd.exe cscript.exe PID 1760 wrote to memory of 432 1760 cmd.exe cscript.exe PID 1760 wrote to memory of 432 1760 cmd.exe cscript.exe PID 4404 wrote to memory of 2600 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 4404 wrote to memory of 2600 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 4404 wrote to memory of 2600 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2600 wrote to memory of 3100 2600 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2600 wrote to memory of 3100 2600 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2600 wrote to memory of 3100 2600 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 4404 wrote to memory of 1064 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 1064 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 1064 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 3692 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 3692 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 3692 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 4636 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 4636 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 4636 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 4404 wrote to memory of 3972 4404 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\JqwMooIQ\eOkwwIUk.exe"C:\Users\Admin\JqwMooIQ\eOkwwIUk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\iuUMgAQw\rwIgIAIY.exe"C:\ProgramData\iuUMgAQw\rwIgIAIY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"130⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock241⤵