Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
-
Size
915KB
-
MD5
545f852cc1f52d76fad52a4f410ba432
-
SHA1
6857449eb58747a188f2b12eeb59655d837df93c
-
SHA256
d39d75fbb6833ccf7c7713b42c85dc9cb8b36c1a3ea8d76514b2431c12a4ddbe
-
SHA512
d1b607b8007d8b77912ca05a95b6bc50e9d2be1e6c4e17b15fd34ad43492af44d1d39763bd4cceca485d592a915892e9a0a2ef8fc2d0b1cb8a63f20e0f843807
-
SSDEEP
12288:ObI8Ciz3ku6SuS2CDgb/zg2XKdVV8GKLJ7Tld6HG/uFxzVlk8ihBhUsKbicv/m+3:pOLkusS2CDM6/V+VGqufpjO01o1eC0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (71) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DaMIgsUE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation DaMIgsUE.exe -
Executes dropped EXE 2 IoCs
Processes:
PIEkkwUM.exeDaMIgsUE.exepid process 1652 PIEkkwUM.exe 224 DaMIgsUE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeDaMIgsUE.exePIEkkwUM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIEkkwUM.exe = "C:\\Users\\Admin\\fckgAQgQ\\PIEkkwUM.exe" 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DaMIgsUE.exe = "C:\\ProgramData\\zSQEccUc\\DaMIgsUE.exe" 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DaMIgsUE.exe = "C:\\ProgramData\\zSQEccUc\\DaMIgsUE.exe" DaMIgsUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIEkkwUM.exe = "C:\\Users\\Admin\\fckgAQgQ\\PIEkkwUM.exe" PIEkkwUM.exe -
Drops file in System32 directory 2 IoCs
Processes:
DaMIgsUE.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe DaMIgsUE.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe DaMIgsUE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2300 reg.exe 1088 reg.exe 4464 912 reg.exe 3468 reg.exe 4452 reg.exe 2456 reg.exe 4048 reg.exe 5088 reg.exe 1872 3880 reg.exe 4088 reg.exe 3992 reg.exe 4164 reg.exe 3468 reg.exe 2760 reg.exe 3572 1540 3352 reg.exe 4716 reg.exe 3876 reg.exe 4004 reg.exe 4612 reg.exe 4480 reg.exe 4716 reg.exe 4912 4472 reg.exe 3024 reg.exe 4716 reg.exe 3292 reg.exe 1272 reg.exe 5008 reg.exe 1428 3932 reg.exe 372 reg.exe 3064 reg.exe 4284 reg.exe 2760 reg.exe 4612 reg.exe 4424 1948 reg.exe 4464 reg.exe 4632 reg.exe 2492 reg.exe 4708 reg.exe 1092 3892 5060 reg.exe 4388 reg.exe 4240 reg.exe 1696 reg.exe 2688 reg.exe 2748 reg.exe 4412 reg.exe 3572 reg.exe 2688 reg.exe 4584 4396 2632 reg.exe 4500 reg.exe 3880 reg.exe 2492 reg.exe 4608 reg.exe 1540 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exepid process 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3772 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3772 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3772 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3772 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2472 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2472 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2472 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2472 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4700 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4700 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4700 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4700 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3688 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3688 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3688 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3688 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3080 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3080 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3080 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3080 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3692 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3692 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3692 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 3692 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4280 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4280 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4280 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4280 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1916 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1916 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1916 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1916 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1536 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1536 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1536 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1536 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2380 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2380 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2380 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2380 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4656 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4656 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4656 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 4656 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2096 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2096 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2096 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2096 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
DaMIgsUE.exepid process 224 DaMIgsUE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
DaMIgsUE.exepid process 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe 224 DaMIgsUE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.execmd.execmd.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.execmd.execmd.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.execmd.exedescription pid process target process PID 2564 wrote to memory of 1652 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PIEkkwUM.exe PID 2564 wrote to memory of 1652 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PIEkkwUM.exe PID 2564 wrote to memory of 1652 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PIEkkwUM.exe PID 2564 wrote to memory of 224 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe DaMIgsUE.exe PID 2564 wrote to memory of 224 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe DaMIgsUE.exe PID 2564 wrote to memory of 224 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe DaMIgsUE.exe PID 2564 wrote to memory of 2032 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2564 wrote to memory of 2032 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2564 wrote to memory of 2032 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2032 wrote to memory of 4608 2032 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2032 wrote to memory of 4608 2032 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2032 wrote to memory of 4608 2032 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2564 wrote to memory of 3456 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 3456 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 3456 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 60 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2564 wrote to memory of 60 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2564 wrote to memory of 60 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2564 wrote to memory of 4956 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 4956 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 4956 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2564 wrote to memory of 4600 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2564 wrote to memory of 4600 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2564 wrote to memory of 4600 2564 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 4600 wrote to memory of 448 4600 cmd.exe cscript.exe PID 4600 wrote to memory of 448 4600 cmd.exe cscript.exe PID 4600 wrote to memory of 448 4600 cmd.exe cscript.exe PID 4608 wrote to memory of 1832 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 4608 wrote to memory of 1832 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 4608 wrote to memory of 1832 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 1832 wrote to memory of 2616 1832 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 1832 wrote to memory of 2616 1832 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 1832 wrote to memory of 2616 1832 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 4608 wrote to memory of 1300 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 4608 wrote to memory of 1300 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 4608 wrote to memory of 1300 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 4608 wrote to memory of 3800 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 3800 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 3800 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 4880 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 4880 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 4880 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 4608 wrote to memory of 4772 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 4608 wrote to memory of 4772 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 4608 wrote to memory of 4772 4608 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 4772 wrote to memory of 556 4772 cmd.exe cscript.exe PID 4772 wrote to memory of 556 4772 cmd.exe cscript.exe PID 4772 wrote to memory of 556 4772 cmd.exe cscript.exe PID 2616 wrote to memory of 4508 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2616 wrote to memory of 4508 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2616 wrote to memory of 4508 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 4508 wrote to memory of 756 4508 cmd.exe reg.exe PID 4508 wrote to memory of 756 4508 cmd.exe reg.exe PID 4508 wrote to memory of 756 4508 cmd.exe reg.exe PID 2616 wrote to memory of 3032 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 3032 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 3032 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 3416 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 3416 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 3416 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Conhost.exe PID 2616 wrote to memory of 5044 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2616 wrote to memory of 5044 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2616 wrote to memory of 5044 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2616 wrote to memory of 3780 2616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\fckgAQgQ\PIEkkwUM.exe"C:\Users\Admin\fckgAQgQ\PIEkkwUM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\zSQEccUc\DaMIgsUE.exe"C:\ProgramData\zSQEccUc\DaMIgsUE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"58⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"210⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1211⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"224⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock241⤵