Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
-
Size
190KB
-
MD5
6e9f6eeb64bbf4811875e387d539594c
-
SHA1
9572b46f4ae05e2aa622f4bfbf9cda6669f9406e
-
SHA256
a30b0c083b8943dd3decaa1060781eca029e425cbb13515505508273bc86de09
-
SHA512
63511bf2430eb766ed1e2444db97dec329477103e6cb3efab1685731203393da069fcbb86f164a834fcd06f25a5871cdaa4c79a614812b030f68b6c282bdc397
-
SSDEEP
3072:lIhcy1CpPxuC+VpNpxXbrIhrniL4LGXlmJ22CWE+i9mZwipq9ML22cr8ml+65fT3:lVywpPQC+VpNpCrnsA7cr3dTgC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (75) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yWMsoAEc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation yWMsoAEc.exe -
Executes dropped EXE 2 IoCs
Processes:
yWMsoAEc.exeIQoAQYoE.exepid process 4872 yWMsoAEc.exe 4772 IQoAQYoE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeyWMsoAEc.exeIQoAQYoE.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IQoAQYoE.exe = "C:\\ProgramData\\AIscQwcg\\IQoAQYoE.exe" 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yWMsoAEc.exe = "C:\\Users\\Admin\\wuYksgIE\\yWMsoAEc.exe" yWMsoAEc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IQoAQYoE.exe = "C:\\ProgramData\\AIscQwcg\\IQoAQYoE.exe" IQoAQYoE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yWMsoAEc.exe = "C:\\Users\\Admin\\wuYksgIE\\yWMsoAEc.exe" 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe -
Drops file in System32 directory 2 IoCs
Processes:
yWMsoAEc.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe yWMsoAEc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe yWMsoAEc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4920 reg.exe 3092 reg.exe 3900 reg.exe 2172 reg.exe 2884 reg.exe 2988 reg.exe 4728 reg.exe 4932 reg.exe 4620 reg.exe 3140 reg.exe 1948 4436 reg.exe 5024 reg.exe 588 2660 1744 reg.exe 1724 reg.exe 1500 reg.exe 2176 reg.exe 1672 reg.exe 3408 reg.exe 3356 reg.exe 4812 reg.exe 3708 2640 3912 reg.exe 544 reg.exe 3216 reg.exe 4868 reg.exe 4780 reg.exe 2236 reg.exe 776 reg.exe 1516 reg.exe 2824 reg.exe 3644 384 reg.exe 452 reg.exe 1528 reg.exe 4692 2812 reg.exe 3232 reg.exe 2116 reg.exe 1532 4208 reg.exe 4172 reg.exe 1432 reg.exe 5096 4596 reg.exe 4748 reg.exe 2212 reg.exe 2588 reg.exe 4908 reg.exe 4956 reg.exe 1692 3680 reg.exe 4636 reg.exe 3900 reg.exe 3308 3680 reg.exe 2068 reg.exe 4596 reg.exe 2840 reg.exe 1920 424 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exepid process 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4956 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4956 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4956 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4956 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2820 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2820 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2820 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2820 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4988 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4988 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4988 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4988 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3112 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3112 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3112 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3112 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3044 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1692 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1692 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1692 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1692 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3680 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3680 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3680 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3680 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2984 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2984 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2984 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2984 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 4144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3480 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3480 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3480 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3480 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1528 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1528 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1528 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1528 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
yWMsoAEc.exepid process 4872 yWMsoAEc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
yWMsoAEc.exepid process 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe 4872 yWMsoAEc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.execmd.execmd.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.execmd.execmd.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.execmd.exedescription pid process target process PID 776 wrote to memory of 4872 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe yWMsoAEc.exe PID 776 wrote to memory of 4872 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe yWMsoAEc.exe PID 776 wrote to memory of 4872 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe yWMsoAEc.exe PID 776 wrote to memory of 4772 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe IQoAQYoE.exe PID 776 wrote to memory of 4772 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe IQoAQYoE.exe PID 776 wrote to memory of 4772 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe IQoAQYoE.exe PID 776 wrote to memory of 2848 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 776 wrote to memory of 2848 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 776 wrote to memory of 2848 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 776 wrote to memory of 2548 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 2548 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 2548 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 684 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 684 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 684 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 1004 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 1004 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 1004 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 776 wrote to memory of 1528 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 776 wrote to memory of 1528 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 776 wrote to memory of 1528 776 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2848 wrote to memory of 2116 2848 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2848 wrote to memory of 2116 2848 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2848 wrote to memory of 2116 2848 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 1528 wrote to memory of 4120 1528 cmd.exe cscript.exe PID 1528 wrote to memory of 4120 1528 cmd.exe cscript.exe PID 1528 wrote to memory of 4120 1528 cmd.exe cscript.exe PID 2116 wrote to memory of 4624 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2116 wrote to memory of 4624 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2116 wrote to memory of 4624 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 4624 wrote to memory of 3192 4624 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 4624 wrote to memory of 3192 4624 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 4624 wrote to memory of 3192 4624 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2116 wrote to memory of 1856 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 1856 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 1856 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2660 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2660 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2660 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2600 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2600 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 2600 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2116 wrote to memory of 4500 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2116 wrote to memory of 4500 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2116 wrote to memory of 4500 2116 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 4500 wrote to memory of 4076 4500 cmd.exe cscript.exe PID 4500 wrote to memory of 4076 4500 cmd.exe cscript.exe PID 4500 wrote to memory of 4076 4500 cmd.exe cscript.exe PID 3192 wrote to memory of 4116 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 3192 wrote to memory of 4116 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 3192 wrote to memory of 4116 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 4116 wrote to memory of 3044 4116 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 4116 wrote to memory of 3044 4116 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 4116 wrote to memory of 3044 4116 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 3192 wrote to memory of 1516 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 1516 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 1516 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 3680 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 3680 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 3680 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 2176 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 2176 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 2176 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 3192 wrote to memory of 1844 3192 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\wuYksgIE\yWMsoAEc.exe"C:\Users\Admin\wuYksgIE\yWMsoAEc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\AIscQwcg\IQoAQYoE.exe"C:\ProgramData\AIscQwcg\IQoAQYoE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"130⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"200⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock241⤵