Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe
-
Size
186KB
-
MD5
4aa9fa508c29d180182fd46b458c3d45
-
SHA1
11887d2a2379f3fa20b641bcb7beb21eec6f3b68
-
SHA256
a9cea6d2aa276b155ff75470230ea28735d9f36619f85197e9a9eec81788ab85
-
SHA512
f320c06d04b4335761ad2b6717c775fc3433657ada320216ffe5d6f31e478598c3c879aae81a0145b3b619373ee729f434bc17f26632e1b5470259f524a90589
-
SSDEEP
3072:Bo41Fyay14bZhykPagbGUlcP003HloLhJO8cvaFmzj4et8CyPJYbwKgkDm:mj1aTdPabE03FuKaFMyPJYbwVAm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
zmwUQEMs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation zmwUQEMs.exe -
Executes dropped EXE 2 IoCs
Processes:
zmwUQEMs.exebKQQYMso.exepid process 4536 zmwUQEMs.exe 1520 bKQQYMso.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bKQQYMso.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exezmwUQEMs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bKQQYMso.exe = "C:\\ProgramData\\voUUMQEw\\bKQQYMso.exe" bKQQYMso.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmwUQEMs.exe = "C:\\Users\\Admin\\rukkwUgk\\zmwUQEMs.exe" 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bKQQYMso.exe = "C:\\ProgramData\\voUUMQEw\\bKQQYMso.exe" 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmwUQEMs.exe = "C:\\Users\\Admin\\rukkwUgk\\zmwUQEMs.exe" zmwUQEMs.exe -
Drops file in System32 directory 2 IoCs
Processes:
zmwUQEMs.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe zmwUQEMs.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe zmwUQEMs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2436 reg.exe 812 reg.exe 1972 reg.exe 5028 reg.exe 5068 reg.exe 2096 reg.exe 4352 reg.exe 4752 reg.exe 1564 reg.exe 2076 reg.exe 1780 reg.exe 3924 reg.exe 5104 reg.exe 1840 reg.exe 1848 reg.exe 1180 1424 reg.exe 4232 reg.exe 2076 reg.exe 3948 reg.exe 2524 3820 reg.exe 1664 reg.exe 468 reg.exe 3584 reg.exe 4212 reg.exe 1180 reg.exe 1420 reg.exe 4016 reg.exe 3568 2668 reg.exe 876 reg.exe 2416 reg.exe 3008 reg.exe 1180 reg.exe 2988 reg.exe 2440 reg.exe 1008 reg.exe 3648 reg.exe 4140 reg.exe 4452 reg.exe 4892 reg.exe 3028 2324 reg.exe 4628 reg.exe 3148 reg.exe 5068 reg.exe 1028 reg.exe 4328 4108 3756 reg.exe 1740 reg.exe 3628 reg.exe 3948 reg.exe 2280 reg.exe 2172 reg.exe 4560 reg.exe 1672 reg.exe 1028 2980 reg.exe 4412 reg.exe 1828 reg.exe 2200 3144 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exepid process 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 876 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 876 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 876 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 876 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3972 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3972 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3972 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3972 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1268 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1268 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1268 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1268 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 984 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 984 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 984 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 984 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3648 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3648 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3648 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 3648 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2656 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2656 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2656 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2656 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4328 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4328 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4328 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4328 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4212 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4212 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4212 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4212 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2892 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2892 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2892 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2892 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4352 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4352 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4352 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4352 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1368 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1368 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1368 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 1368 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2020 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2020 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2020 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 2020 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4420 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4420 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4420 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe 4420 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
zmwUQEMs.exepid process 4536 zmwUQEMs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
zmwUQEMs.exepid process 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe 4536 zmwUQEMs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.execmd.execmd.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.execmd.execmd.exe2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.execmd.exedescription pid process target process PID 4564 wrote to memory of 4536 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe zmwUQEMs.exe PID 4564 wrote to memory of 4536 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe zmwUQEMs.exe PID 4564 wrote to memory of 4536 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe zmwUQEMs.exe PID 4564 wrote to memory of 1520 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe bKQQYMso.exe PID 4564 wrote to memory of 1520 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe bKQQYMso.exe PID 4564 wrote to memory of 1520 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe bKQQYMso.exe PID 4564 wrote to memory of 1900 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 4564 wrote to memory of 1900 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 4564 wrote to memory of 1900 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1900 wrote to memory of 1224 1900 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 1900 wrote to memory of 1224 1900 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 1900 wrote to memory of 1224 1900 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 4564 wrote to memory of 648 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 648 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 648 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 2324 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 2324 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 2324 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 1480 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 1480 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 1480 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 4564 wrote to memory of 3664 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 4564 wrote to memory of 3664 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 4564 wrote to memory of 3664 4564 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 3664 wrote to memory of 3000 3664 cmd.exe cscript.exe PID 3664 wrote to memory of 3000 3664 cmd.exe cscript.exe PID 3664 wrote to memory of 3000 3664 cmd.exe cscript.exe PID 1224 wrote to memory of 4404 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1224 wrote to memory of 4404 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1224 wrote to memory of 4404 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 4404 wrote to memory of 1288 4404 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 4404 wrote to memory of 1288 4404 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 4404 wrote to memory of 1288 4404 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 1224 wrote to memory of 3756 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 3756 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 3756 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 2480 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 2480 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 2480 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 1904 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 1904 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 1904 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1224 wrote to memory of 5096 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1224 wrote to memory of 5096 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1224 wrote to memory of 5096 1224 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 5096 wrote to memory of 1596 5096 cmd.exe cscript.exe PID 5096 wrote to memory of 1596 5096 cmd.exe cscript.exe PID 5096 wrote to memory of 1596 5096 cmd.exe cscript.exe PID 1288 wrote to memory of 2656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1288 wrote to memory of 2656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 1288 wrote to memory of 2656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe PID 2656 wrote to memory of 876 2656 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 2656 wrote to memory of 876 2656 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 2656 wrote to memory of 876 2656 cmd.exe 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe PID 1288 wrote to memory of 3420 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 3420 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 3420 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 1656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 1656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 1656 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 3572 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 3572 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 3572 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe reg.exe PID 1288 wrote to memory of 2980 1288 2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\rukkwUgk\zmwUQEMs.exe"C:\Users\Admin\rukkwUgk\zmwUQEMs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\voUUMQEw\bKQQYMso.exe"C:\ProgramData\voUUMQEw\bKQQYMso.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"142⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"200⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"224⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_4aa9fa508c29d180182fd46b458c3d45_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵