Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
-
Size
268KB
-
MD5
5b3e104a28b0fe470b49d27e6fd466de
-
SHA1
21081cd1114148f53787375dbbf23b15bec2fbc8
-
SHA256
e03f859ec2b9ae57590beb8d1acb4225b819e445ac638243e566f7a0466788cf
-
SHA512
1765e99245312028831d496e890ca68c8906651a355d6304408ab1e39d812ded00e0ace00b665de7b81eaba89a570c12e88bb7e9bd3def234b209cbe4f10403e
-
SSDEEP
3072:AolMtIr0rbOKsZM3XjcuvzrEtLWeCbMO72UVAFaZ15M9BZUHdZK1yBbEpCI3BaUx:Ao+uwDFBwWeCZ7H7ZY9cy1Ib/vQnF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (85) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pYsMIEIM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation pYsMIEIM.exe -
Executes dropped EXE 2 IoCs
Processes:
KQQYQIUs.exepYsMIEIM.exepid process 2920 KQQYQIUs.exe 2900 pYsMIEIM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exepYsMIEIM.exeKQQYQIUs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KQQYQIUs.exe = "C:\\Users\\Admin\\UggwgQok\\KQQYQIUs.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pYsMIEIM.exe = "C:\\ProgramData\\fKQAwUYY\\pYsMIEIM.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pYsMIEIM.exe = "C:\\ProgramData\\fKQAwUYY\\pYsMIEIM.exe" pYsMIEIM.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KQQYQIUs.exe = "C:\\Users\\Admin\\UggwgQok\\KQQYQIUs.exe" KQQYQIUs.exe -
Drops file in System32 directory 2 IoCs
Processes:
pYsMIEIM.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe pYsMIEIM.exe File created C:\Windows\SysWOW64\shell32.dll.exe pYsMIEIM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2784 reg.exe 2708 reg.exe 3472 reg.exe 3752 reg.exe 3552 reg.exe 940 reg.exe 1780 reg.exe 3552 reg.exe 3944 3944 reg.exe 4140 reg.exe 2084 3100 4680 reg.exe 1524 reg.exe 4304 reg.exe 520 reg.exe 1192 reg.exe 3676 reg.exe 4584 reg.exe 1196 reg.exe 2788 reg.exe 876 reg.exe 2344 reg.exe 452 reg.exe 4484 reg.exe 2036 reg.exe 4224 reg.exe 648 reg.exe 744 reg.exe 4044 reg.exe 4348 reg.exe 2468 reg.exe 4300 reg.exe 904 reg.exe 3588 reg.exe 3628 reg.exe 1140 reg.exe 3484 reg.exe 1196 reg.exe 3240 reg.exe 1496 reg.exe 2448 reg.exe 4440 reg.exe 2472 reg.exe 3104 reg.exe 4160 reg.exe 4164 reg.exe 3496 reg.exe 4168 reg.exe 5108 reg.exe 3116 reg.exe 2596 reg.exe 4776 reg.exe 2708 972 reg.exe 2700 reg.exe 5036 reg.exe 3896 reg.exe 3628 1888 reg.exe 2340 reg.exe 3944 reg.exe 4164 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exepid process 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1076 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1076 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1076 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1076 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 3496 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 3496 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 3496 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 3496 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 520 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 520 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 520 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 520 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4532 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4532 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4532 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4532 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1492 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1492 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1492 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1492 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4296 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4296 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4296 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4296 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2996 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2996 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2996 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2996 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2864 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2864 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2864 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2864 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 4312 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1460 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1460 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1460 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1460 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5032 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5032 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5032 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 5032 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pYsMIEIM.exepid process 2900 pYsMIEIM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
pYsMIEIM.exepid process 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe 2900 pYsMIEIM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.execmd.execmd.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.execmd.execmd.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.execmd.exedescription pid process target process PID 1668 wrote to memory of 2920 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe KQQYQIUs.exe PID 1668 wrote to memory of 2920 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe KQQYQIUs.exe PID 1668 wrote to memory of 2920 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe KQQYQIUs.exe PID 1668 wrote to memory of 2900 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe pYsMIEIM.exe PID 1668 wrote to memory of 2900 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe pYsMIEIM.exe PID 1668 wrote to memory of 2900 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe pYsMIEIM.exe PID 1668 wrote to memory of 3724 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1668 wrote to memory of 3724 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1668 wrote to memory of 3724 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 3724 wrote to memory of 4348 3724 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 3724 wrote to memory of 4348 3724 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 3724 wrote to memory of 4348 3724 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 1668 wrote to memory of 2316 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 2316 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 2316 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 1416 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 1416 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 1416 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 4712 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 4712 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 4712 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1668 wrote to memory of 3896 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1668 wrote to memory of 3896 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1668 wrote to memory of 3896 1668 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 3896 wrote to memory of 5088 3896 cmd.exe cscript.exe PID 3896 wrote to memory of 5088 3896 cmd.exe cscript.exe PID 3896 wrote to memory of 5088 3896 cmd.exe cscript.exe PID 4348 wrote to memory of 1288 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 4348 wrote to memory of 1288 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 4348 wrote to memory of 1288 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1288 wrote to memory of 5012 1288 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 1288 wrote to memory of 5012 1288 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 1288 wrote to memory of 5012 1288 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 4348 wrote to memory of 4116 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 4116 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 4116 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 648 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 648 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 648 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 1460 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 1460 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 1460 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 4348 wrote to memory of 4680 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 4348 wrote to memory of 4680 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 4348 wrote to memory of 4680 4348 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 4680 wrote to memory of 3292 4680 cmd.exe cscript.exe PID 4680 wrote to memory of 3292 4680 cmd.exe cscript.exe PID 4680 wrote to memory of 3292 4680 cmd.exe cscript.exe PID 5012 wrote to memory of 2600 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 5012 wrote to memory of 2600 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 5012 wrote to memory of 2600 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2600 wrote to memory of 1076 2600 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2600 wrote to memory of 1076 2600 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2600 wrote to memory of 1076 2600 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 5012 wrote to memory of 2472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 2472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 2472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 4472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 4472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 4472 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 2880 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 2880 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 2880 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 5012 wrote to memory of 3004 5012 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\UggwgQok\KQQYQIUs.exe"C:\Users\Admin\UggwgQok\KQQYQIUs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\fKQAwUYY\pYsMIEIM.exe"C:\ProgramData\fKQAwUYY\pYsMIEIM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"142⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵