Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe
-
Size
186KB
-
MD5
9d3d1c00327687109407abc8badbde36
-
SHA1
b6dae2d12fdd7e0d8d09e3400cb3e6274cb72b90
-
SHA256
4cecb2df677c152f8e95a952c2c5f05ce443bbeaf547ff401ee66a752dfc8f13
-
SHA512
5f02912b8607f70b1585c54ca5544afa2b4d3229767e2e94c2eac45cf0b13a289d37f5de1059d917c9cd96a68d30f8254e23c295d2abb6a49d1bb9d4108dead0
-
SSDEEP
3072:4axc8vz5CGw7CD4h3utsYlbBSQ8MLW4B1bDRAxe3SxuekTYk/:Rxc8vz5CGwmD4h3utDBSpt4BYWSxupTB
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (85) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 1 IoCs
Processes:
flow pid process 34 928 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fkAscMME.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation fkAscMME.exe -
Executes dropped EXE 2 IoCs
Processes:
fkAscMME.exeGgooUMwI.exepid process 1280 fkAscMME.exe 3160 GgooUMwI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exefkAscMME.exeGgooUMwI.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fkAscMME.exe = "C:\\Users\\Admin\\DqsQkQsg\\fkAscMME.exe" 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GgooUMwI.exe = "C:\\ProgramData\\NYIEkQMk\\GgooUMwI.exe" 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fkAscMME.exe = "C:\\Users\\Admin\\DqsQkQsg\\fkAscMME.exe" fkAscMME.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GgooUMwI.exe = "C:\\ProgramData\\NYIEkQMk\\GgooUMwI.exe" GgooUMwI.exe -
Drops file in System32 directory 2 IoCs
Processes:
fkAscMME.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe fkAscMME.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe fkAscMME.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3244 reg.exe 3488 reg.exe 4316 reg.exe 3632 reg.exe 1192 reg.exe 2468 reg.exe 1880 reg.exe 2548 reg.exe 1388 reg.exe 1812 1876 reg.exe 2004 reg.exe 3104 reg.exe 932 reg.exe 5056 reg.exe 1036 reg.exe 2376 reg.exe 3748 reg.exe 3148 reg.exe 1044 reg.exe 4860 reg.exe 4640 reg.exe 3672 reg.exe 3148 reg.exe 2740 reg.exe 3236 reg.exe 996 reg.exe 8 reg.exe 1148 reg.exe 4808 reg.exe 3868 reg.exe 4564 reg.exe 1600 reg.exe 688 reg.exe 2404 reg.exe 4812 reg.exe 2688 reg.exe 2556 reg.exe 5112 reg.exe 1380 reg.exe 4868 reg.exe 4312 reg.exe 3956 3272 4160 reg.exe 4784 reg.exe 688 reg.exe 2144 reg.exe 2404 4156 reg.exe 5028 reg.exe 932 reg.exe 4632 reg.exe 5028 3076 reg.exe 4464 reg.exe 3768 reg.exe 3148 reg.exe 4580 reg.exe 3592 reg.exe 2056 reg.exe 4580 reg.exe 4532 reg.exe 4448 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exepid process 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2028 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2028 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2028 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2028 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3500 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3500 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3500 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3500 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2564 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2564 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2564 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 2564 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3148 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3148 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3148 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3148 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1644 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1644 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1644 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1644 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3640 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3640 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3640 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3640 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3952 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3952 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3952 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3952 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4808 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4808 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4808 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4808 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4920 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4920 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4920 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4920 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 4620 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3476 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3476 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3476 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 3476 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1236 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1236 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1236 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe 1236 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fkAscMME.exepid process 1280 fkAscMME.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
fkAscMME.exepid process 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe 1280 fkAscMME.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.execmd.execmd.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.execmd.execmd.exe2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.execmd.exedescription pid process target process PID 4272 wrote to memory of 1280 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe fkAscMME.exe PID 4272 wrote to memory of 1280 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe fkAscMME.exe PID 4272 wrote to memory of 1280 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe fkAscMME.exe PID 4272 wrote to memory of 3160 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe GgooUMwI.exe PID 4272 wrote to memory of 3160 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe GgooUMwI.exe PID 4272 wrote to memory of 3160 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe GgooUMwI.exe PID 4272 wrote to memory of 3368 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4272 wrote to memory of 3368 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4272 wrote to memory of 3368 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3368 wrote to memory of 3212 3368 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 3368 wrote to memory of 3212 3368 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 3368 wrote to memory of 3212 3368 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 4272 wrote to memory of 4828 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 4828 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 4828 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 2752 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 2752 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 2752 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 1132 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 1132 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 1132 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4272 wrote to memory of 3916 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4272 wrote to memory of 3916 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4272 wrote to memory of 3916 4272 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3916 wrote to memory of 4752 3916 cmd.exe cscript.exe PID 3916 wrote to memory of 4752 3916 cmd.exe cscript.exe PID 3916 wrote to memory of 4752 3916 cmd.exe cscript.exe PID 3212 wrote to memory of 2700 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3212 wrote to memory of 2700 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3212 wrote to memory of 2700 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 2700 wrote to memory of 4088 2700 cmd.exe reg.exe PID 2700 wrote to memory of 4088 2700 cmd.exe reg.exe PID 2700 wrote to memory of 4088 2700 cmd.exe reg.exe PID 3212 wrote to memory of 8 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 8 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 8 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 5052 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 5052 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 5052 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 3076 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 3076 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 3076 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 3212 wrote to memory of 4624 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3212 wrote to memory of 4624 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3212 wrote to memory of 4624 3212 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4624 wrote to memory of 4792 4624 cmd.exe cscript.exe PID 4624 wrote to memory of 4792 4624 cmd.exe cscript.exe PID 4624 wrote to memory of 4792 4624 cmd.exe cscript.exe PID 4088 wrote to memory of 3844 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4088 wrote to memory of 3844 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 4088 wrote to memory of 3844 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe PID 3844 wrote to memory of 2028 3844 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 3844 wrote to memory of 2028 3844 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 3844 wrote to memory of 2028 3844 cmd.exe 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe PID 4088 wrote to memory of 4552 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 4552 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 4552 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 628 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 628 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 628 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 5116 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 5116 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 5116 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe reg.exe PID 4088 wrote to memory of 4528 4088 2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\DqsQkQsg\fkAscMME.exe"C:\Users\Admin\DqsQkQsg\fkAscMME.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\NYIEkQMk\GgooUMwI.exe"C:\ProgramData\NYIEkQMk\GgooUMwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"200⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"210⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1211⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"224⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9d3d1c00327687109407abc8badbde36_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵