Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
-
Size
207KB
-
MD5
e3c42193dded9876352767a756e25772
-
SHA1
cfb23b31cc2955f593c4ed45a796ea0fb29977cf
-
SHA256
d067c9715106133877f2259a391af73fbd65340d78c6d62af6aa4272fed0478e
-
SHA512
5698e7ef79ab7accf21eaf940f9fb846df7b2ae6e86fb26595b9319addccc150a9343e0328fab37b9ef0f3e9ddf51fb7e7ed60431a9736f9368b314e4ab03a10
-
SSDEEP
3072:9plXxnpZtSqnxbRAHazBjDxAm+NuM2qqk5lt9B+mL/Q5CoW1lDeeXw:zlXxnftrLA6zBjDxGNmwltXJ/Q5obZA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
UccoUEYQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation UccoUEYQ.exe -
Executes dropped EXE 2 IoCs
Processes:
bawwcQkU.exeUccoUEYQ.exepid process 4472 bawwcQkU.exe 1192 UccoUEYQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeUccoUEYQ.exebawwcQkU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bawwcQkU.exe = "C:\\Users\\Admin\\SaggkMgk\\bawwcQkU.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UccoUEYQ.exe = "C:\\ProgramData\\pQkwUAQc\\UccoUEYQ.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UccoUEYQ.exe = "C:\\ProgramData\\pQkwUAQc\\UccoUEYQ.exe" UccoUEYQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bawwcQkU.exe = "C:\\Users\\Admin\\SaggkMgk\\bawwcQkU.exe" bawwcQkU.exe -
Drops file in System32 directory 2 IoCs
Processes:
UccoUEYQ.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe UccoUEYQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe UccoUEYQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4868 reg.exe 1320 reg.exe 4968 reg.exe 408 reg.exe 220 reg.exe 392 reg.exe 1308 reg.exe 2784 reg.exe 1552 reg.exe 5044 3492 3092 reg.exe 992 reg.exe 1320 reg.exe 1180 reg.exe 2268 reg.exe 636 reg.exe 4596 reg.exe 208 reg.exe 3324 reg.exe 1604 reg.exe 5052 reg.exe 4608 reg.exe 2024 reg.exe 5116 reg.exe 2320 reg.exe 4960 reg.exe 2948 reg.exe 4908 reg.exe 2108 reg.exe 3648 reg.exe 5008 reg.exe 2220 reg.exe 2100 reg.exe 2268 2260 reg.exe 3532 reg.exe 2700 reg.exe 5064 reg.exe 392 reg.exe 4820 reg.exe 3420 reg.exe 3644 3360 reg.exe 1320 reg.exe 3544 reg.exe 4912 reg.exe 408 reg.exe 2116 reg.exe 4896 reg.exe 3576 reg.exe 4880 reg.exe 2584 reg.exe 1680 reg.exe 3880 reg.exe 372 reg.exe 3324 reg.exe 440 1920 reg.exe 3332 reg.exe 980 reg.exe 1032 reg.exe 3484 reg.exe 4328 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exepid process 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3524 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3524 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3524 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3524 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4896 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4896 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4896 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4896 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4604 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4604 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4604 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4604 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2920 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2920 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2920 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2920 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4660 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4660 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4660 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4660 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4880 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4880 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4880 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4880 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2616 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2616 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2616 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2616 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1436 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1436 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1436 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1436 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 220 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 220 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 220 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 220 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 3788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1084 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1084 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1084 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1084 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4060 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4060 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4060 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 4060 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
UccoUEYQ.exepid process 1192 UccoUEYQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
UccoUEYQ.exepid process 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe 1192 UccoUEYQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.execmd.execmd.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.execmd.execmd.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.execmd.exedescription pid process target process PID 4288 wrote to memory of 4472 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe bawwcQkU.exe PID 4288 wrote to memory of 4472 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe bawwcQkU.exe PID 4288 wrote to memory of 4472 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe bawwcQkU.exe PID 4288 wrote to memory of 1192 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe UccoUEYQ.exe PID 4288 wrote to memory of 1192 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe UccoUEYQ.exe PID 4288 wrote to memory of 1192 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe UccoUEYQ.exe PID 4288 wrote to memory of 5044 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4288 wrote to memory of 5044 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4288 wrote to memory of 5044 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 5044 wrote to memory of 4540 5044 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 5044 wrote to memory of 4540 5044 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 5044 wrote to memory of 4540 5044 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 4288 wrote to memory of 440 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 440 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 440 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 4820 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 4820 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 4820 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 5004 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 5004 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 5004 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4288 wrote to memory of 4612 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4288 wrote to memory of 4612 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4288 wrote to memory of 4612 4288 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4612 wrote to memory of 1448 4612 cmd.exe cscript.exe PID 4612 wrote to memory of 1448 4612 cmd.exe cscript.exe PID 4612 wrote to memory of 1448 4612 cmd.exe cscript.exe PID 4540 wrote to memory of 3144 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4540 wrote to memory of 3144 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4540 wrote to memory of 3144 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 3144 wrote to memory of 2860 3144 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 3144 wrote to memory of 2860 3144 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 3144 wrote to memory of 2860 3144 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 4540 wrote to memory of 3660 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 3660 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 3660 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 4688 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 4688 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 4688 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 1948 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 1948 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 1948 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 4540 wrote to memory of 3064 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4540 wrote to memory of 3064 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4540 wrote to memory of 3064 4540 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 3064 wrote to memory of 2876 3064 cmd.exe cscript.exe PID 3064 wrote to memory of 2876 3064 cmd.exe cscript.exe PID 3064 wrote to memory of 2876 3064 cmd.exe cscript.exe PID 2860 wrote to memory of 4856 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2860 wrote to memory of 4856 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2860 wrote to memory of 4856 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 4856 wrote to memory of 3524 4856 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 4856 wrote to memory of 3524 4856 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 4856 wrote to memory of 3524 4856 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2860 wrote to memory of 220 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 220 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 220 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 768 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 768 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 768 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 1612 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 1612 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 1612 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2860 wrote to memory of 4692 2860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SaggkMgk\bawwcQkU.exe"C:\Users\Admin\SaggkMgk\bawwcQkU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\pQkwUAQc\UccoUEYQ.exe"C:\ProgramData\pQkwUAQc\UccoUEYQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"162⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"182⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"210⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1211⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock241⤵