Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
-
Size
193KB
-
MD5
dc4229425e844f005b38928831df7b58
-
SHA1
8a5b8c851a37bea0e0f1e224ae7b630ea29e80b5
-
SHA256
6d8e7697a09363ecf9150887fc5a2084ba84f9fa0600b9ce269323ce5462b61a
-
SHA512
bdce3cc1ddeb3ef3ba9439c2b41369c59715593f8ef41f537098a49a5e8ea9f9175478390d6558d876b7ff8a84b22ec6dce89613c2bd5337fc14517bb3f592b2
-
SSDEEP
6144:zA7Eud7wrDlqjRqHSjU48Lngok43fETVa4y:kd7sxYTqnXchy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (79) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yywgoIgI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation yywgoIgI.exe -
Executes dropped EXE 2 IoCs
Processes:
yywgoIgI.exeuWEkgcYU.exepid process 4532 yywgoIgI.exe 2848 uWEkgcYU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeyywgoIgI.exeuWEkgcYU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yywgoIgI.exe = "C:\\Users\\Admin\\xKcoIogM\\yywgoIgI.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uWEkgcYU.exe = "C:\\ProgramData\\hOAIswQk\\uWEkgcYU.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yywgoIgI.exe = "C:\\Users\\Admin\\xKcoIogM\\yywgoIgI.exe" yywgoIgI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uWEkgcYU.exe = "C:\\ProgramData\\hOAIswQk\\uWEkgcYU.exe" uWEkgcYU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4548 856 reg.exe 4464 reg.exe 384 reg.exe 4776 reg.exe 3956 reg.exe 2860 reg.exe 528 reg.exe 3428 2052 reg.exe 4548 reg.exe 732 reg.exe 3744 reg.exe 2264 reg.exe 3248 reg.exe 4288 reg.exe 2296 reg.exe 3712 reg.exe 3080 reg.exe 3188 reg.exe 4984 reg.exe 3860 reg.exe 3788 reg.exe 4392 reg.exe 1700 reg.exe 3048 reg.exe 1940 reg.exe 604 4556 reg.exe 4060 reg.exe 4372 reg.exe 3092 reg.exe 1636 4548 reg.exe 3780 reg.exe 4112 reg.exe 5084 reg.exe 5088 reg.exe 1608 reg.exe 2240 reg.exe 3092 reg.exe 4732 reg.exe 3988 reg.exe 1356 reg.exe 184 reg.exe 4768 reg.exe 3096 3008 reg.exe 3320 2804 reg.exe 4508 reg.exe 2264 reg.exe 3984 reg.exe 4424 reg.exe 4896 reg.exe 3548 4732 reg.exe 4016 reg.exe 512 reg.exe 3788 reg.exe 1516 reg.exe 1820 reg.exe 1320 reg.exe 5096 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exepid process 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4948 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4948 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4948 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4948 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2740 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2740 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2740 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2740 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2412 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2412 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2412 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2412 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3208 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3208 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3208 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3208 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2128 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2128 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2128 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2128 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1940 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3896 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3896 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3896 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3896 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4980 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4980 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4980 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 4980 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 3732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
yywgoIgI.exepid process 4532 yywgoIgI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
yywgoIgI.exepid process 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe 4532 yywgoIgI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.execmd.execmd.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.execmd.execmd.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.execmd.exedescription pid process target process PID 2960 wrote to memory of 4532 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe yywgoIgI.exe PID 2960 wrote to memory of 4532 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe yywgoIgI.exe PID 2960 wrote to memory of 4532 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe yywgoIgI.exe PID 2960 wrote to memory of 2848 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe uWEkgcYU.exe PID 2960 wrote to memory of 2848 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe uWEkgcYU.exe PID 2960 wrote to memory of 2848 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe uWEkgcYU.exe PID 2960 wrote to memory of 2412 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2960 wrote to memory of 2412 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2960 wrote to memory of 2412 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2960 wrote to memory of 1232 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 1232 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 1232 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2412 wrote to memory of 3188 2412 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2412 wrote to memory of 3188 2412 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2412 wrote to memory of 3188 2412 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2960 wrote to memory of 3048 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 3048 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 3048 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 3396 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 3396 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 3396 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2960 wrote to memory of 2980 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2960 wrote to memory of 2980 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2960 wrote to memory of 2980 2960 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2980 wrote to memory of 2000 2980 cmd.exe cscript.exe PID 2980 wrote to memory of 2000 2980 cmd.exe cscript.exe PID 2980 wrote to memory of 2000 2980 cmd.exe cscript.exe PID 3188 wrote to memory of 2528 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 3188 wrote to memory of 2528 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 3188 wrote to memory of 2528 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2528 wrote to memory of 1764 2528 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2528 wrote to memory of 1764 2528 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2528 wrote to memory of 1764 2528 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 3188 wrote to memory of 4564 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 4564 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 4564 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 3744 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 3744 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 3744 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 2688 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 2688 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 2688 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 3188 wrote to memory of 1244 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 3188 wrote to memory of 1244 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 3188 wrote to memory of 1244 3188 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1244 wrote to memory of 1688 1244 cmd.exe cscript.exe PID 1244 wrote to memory of 1688 1244 cmd.exe cscript.exe PID 1244 wrote to memory of 1688 1244 cmd.exe cscript.exe PID 1764 wrote to memory of 1080 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1764 wrote to memory of 1080 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1764 wrote to memory of 1080 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1764 wrote to memory of 448 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 448 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 448 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 3416 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 3416 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 3416 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 2296 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 2296 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 2296 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 1764 wrote to memory of 856 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1764 wrote to memory of 856 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1764 wrote to memory of 856 1764 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 856 wrote to memory of 4200 856 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xKcoIogM\yywgoIgI.exe"C:\Users\Admin\xKcoIogM\yywgoIgI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\hOAIswQk\uWEkgcYU.exe"C:\ProgramData\hOAIswQk\uWEkgcYU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"136⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"182⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock241⤵