Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
-
Size
199KB
-
MD5
978f428348a12660ee885c1f6e34d926
-
SHA1
dd994c28e1df0d4b77972c4c4d796f425e9c446b
-
SHA256
1a5d387ff5859dc880c62a9bc50ee448c464ca998a986d8c1eb93b7c824ed374
-
SHA512
763bcf72b4865e3b285ceacd2385de465a5616f1993aa52b6dd3d786b68a67cbdcb196e8956efe7f49118b8e385fcb14d42ee7dd960c6b5c8caae8eb2b568606
-
SSDEEP
3072:2RTym7D6XCydNyPGfBAz5pttQ6hKztASqbQUbmYtrP/fFVQ1tH0j:2tL7QzfBa5ptJKRASqbQsmYe1tHI
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SaIcgwog.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SaIcgwog.exe -
Executes dropped EXE 2 IoCs
Processes:
SaIcgwog.exeAAMUUcMg.exepid process 4892 SaIcgwog.exe 2952 AAMUUcMg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeSaIcgwog.exeAAMUUcMg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SaIcgwog.exe = "C:\\Users\\Admin\\AaEkcYAE\\SaIcgwog.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AAMUUcMg.exe = "C:\\ProgramData\\tSMcEwsk\\AAMUUcMg.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SaIcgwog.exe = "C:\\Users\\Admin\\AaEkcYAE\\SaIcgwog.exe" SaIcgwog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AAMUUcMg.exe = "C:\\ProgramData\\tSMcEwsk\\AAMUUcMg.exe" AAMUUcMg.exe -
Drops file in System32 directory 2 IoCs
Processes:
SaIcgwog.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe SaIcgwog.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe SaIcgwog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2416 reg.exe 4868 reg.exe 4808 reg.exe 4424 reg.exe 4268 reg.exe 2192 reg.exe 2600 reg.exe 2700 reg.exe 412 reg.exe 4984 reg.exe 2844 reg.exe 2648 reg.exe 3012 4732 reg.exe 2820 reg.exe 4928 reg.exe 4700 reg.exe 2916 reg.exe 1280 reg.exe 2796 reg.exe 2660 reg.exe 4300 reg.exe 4672 2948 reg.exe 4672 reg.exe 3220 reg.exe 368 reg.exe 2800 reg.exe 3548 reg.exe 1868 reg.exe 3968 reg.exe 2416 reg.exe 2640 reg.exe 1324 reg.exe 700 reg.exe 3512 reg.exe 3924 reg.exe 5064 reg.exe 4684 reg.exe 4344 reg.exe 1636 reg.exe 1988 reg.exe 4656 reg.exe 2004 reg.exe 4536 reg.exe 4380 reg.exe 1992 reg.exe 1204 reg.exe 4984 reg.exe 3940 reg.exe 4136 reg.exe 4020 reg.exe 1184 reg.exe 5076 reg.exe 1092 reg.exe 4332 reg.exe 4252 reg.exe 3940 reg.exe 628 reg.exe 1628 reg.exe 3552 reg.exe 3236 628 reg.exe 4336 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exepid process 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3448 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3448 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3448 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3448 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 5048 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 5048 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 5048 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 5048 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2476 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2476 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2476 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2476 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4556 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4556 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4556 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 4556 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1408 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1408 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1408 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1408 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3984 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3984 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3984 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3984 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1772 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1772 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1772 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1772 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3532 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3532 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3532 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3532 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 464 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 464 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 464 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 464 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3360 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3360 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3360 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3360 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1084 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1084 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1084 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1084 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1932 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1932 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1932 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1932 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SaIcgwog.exepid process 4892 SaIcgwog.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
SaIcgwog.exepid process 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe 4892 SaIcgwog.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.execmd.execmd.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.execmd.execmd.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.execmd.exedescription pid process target process PID 1180 wrote to memory of 4892 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe SaIcgwog.exe PID 1180 wrote to memory of 4892 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe SaIcgwog.exe PID 1180 wrote to memory of 4892 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe SaIcgwog.exe PID 1180 wrote to memory of 2952 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe AAMUUcMg.exe PID 1180 wrote to memory of 2952 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe AAMUUcMg.exe PID 1180 wrote to memory of 2952 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe AAMUUcMg.exe PID 1180 wrote to memory of 4556 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1180 wrote to memory of 4556 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1180 wrote to memory of 4556 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 4556 wrote to memory of 3988 4556 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 4556 wrote to memory of 3988 4556 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 4556 wrote to memory of 3988 4556 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 1180 wrote to memory of 3324 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 3324 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 3324 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 868 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 868 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 868 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 4488 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 4488 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 4488 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1180 wrote to memory of 4812 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1180 wrote to memory of 4812 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1180 wrote to memory of 4812 1180 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 4812 wrote to memory of 3864 4812 cmd.exe cscript.exe PID 4812 wrote to memory of 3864 4812 cmd.exe cscript.exe PID 4812 wrote to memory of 3864 4812 cmd.exe cscript.exe PID 3988 wrote to memory of 1332 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 3988 wrote to memory of 1332 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 3988 wrote to memory of 1332 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1332 wrote to memory of 4980 1332 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 1332 wrote to memory of 4980 1332 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 1332 wrote to memory of 4980 1332 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 3988 wrote to memory of 624 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 624 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 624 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4408 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4408 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4408 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4872 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4872 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 4872 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 3988 wrote to memory of 2504 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 3988 wrote to memory of 2504 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 3988 wrote to memory of 2504 3988 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2504 wrote to memory of 656 2504 cmd.exe cscript.exe PID 2504 wrote to memory of 656 2504 cmd.exe cscript.exe PID 2504 wrote to memory of 656 2504 cmd.exe cscript.exe PID 4980 wrote to memory of 2940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 4980 wrote to memory of 2940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 4980 wrote to memory of 2940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2940 wrote to memory of 3448 2940 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2940 wrote to memory of 3448 2940 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2940 wrote to memory of 3448 2940 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 4980 wrote to memory of 4984 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 4984 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 4984 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 700 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 700 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 700 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 1940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 1940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 1940 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 4980 wrote to memory of 1300 4980 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AaEkcYAE\SaIcgwog.exe"C:\Users\Admin\AaEkcYAE\SaIcgwog.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\tSMcEwsk\AAMUUcMg.exe"C:\ProgramData\tSMcEwsk\AAMUUcMg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock241⤵