Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
-
Size
185KB
-
MD5
1803e61f2f3642ff828ed67ef87f2ac3
-
SHA1
a583696ef62a777db8bda831b534788875774237
-
SHA256
703f5ad176aeca11852b2844e17de901ba022e714484e3208408b8e915ff23b4
-
SHA512
cafdfec6a55cc596d78ae8b8d85583aa7de29fcdb380186812f4eedbb671718a563b2c23e75e823d5746edfff997d34c609eae091564547f238aca980c143cd3
-
SSDEEP
3072:3wVPKOlgM4g637M3G1wm3XFk1nZ5alX/EqN1cLvuOabxAO/nRNjY557JdiCq:gVyOlgM4gg7M3G73XFk1nZ5alXc1TO/f
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
KEAEcAQw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation KEAEcAQw.exe -
Executes dropped EXE 2 IoCs
Processes:
ukAYAMUo.exeKEAEcAQw.exepid process 3416 ukAYAMUo.exe 4908 KEAEcAQw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeukAYAMUo.exeKEAEcAQw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ukAYAMUo.exe = "C:\\Users\\Admin\\NoQogkwc\\ukAYAMUo.exe" 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KEAEcAQw.exe = "C:\\ProgramData\\tYMAksos\\KEAEcAQw.exe" 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ukAYAMUo.exe = "C:\\Users\\Admin\\NoQogkwc\\ukAYAMUo.exe" ukAYAMUo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KEAEcAQw.exe = "C:\\ProgramData\\tYMAksos\\KEAEcAQw.exe" KEAEcAQw.exe -
Drops file in System32 directory 2 IoCs
Processes:
KEAEcAQw.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe KEAEcAQw.exe File created C:\Windows\SysWOW64\shell32.dll.exe KEAEcAQw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1196 reg.exe 3844 reg.exe 364 916 reg.exe 3128 reg.exe 3924 reg.exe 1916 reg.exe 3940 reg.exe 3788 4920 reg.exe 3404 828 4788 856 828 reg.exe 2484 4984 reg.exe 3440 reg.exe 1312 reg.exe 2768 reg.exe 2488 reg.exe 3432 reg.exe 3652 reg.exe 1628 reg.exe 1184 reg.exe 2708 2040 4260 reg.exe 3828 reg.exe 1824 reg.exe 1120 reg.exe 3548 reg.exe 4084 reg.exe 3228 reg.exe 4696 reg.exe 4892 3608 3576 reg.exe 3608 reg.exe 2836 reg.exe 4164 reg.exe 3364 reg.exe 448 reg.exe 4848 reg.exe 4836 reg.exe 1428 reg.exe 3188 reg.exe 4472 reg.exe 2764 reg.exe 1640 reg.exe 1120 reg.exe 1432 reg.exe 428 reg.exe 5020 reg.exe 1496 reg.exe 2128 reg.exe 1792 1824 reg.exe 1040 reg.exe 3084 reg.exe 2424 reg.exe 364 reg.exe 1632 reg.exe 4916 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exepid process 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2748 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2748 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2748 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2748 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4596 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4596 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4596 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4596 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2528 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2528 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2528 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2528 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1628 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1628 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1628 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1628 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3212 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3212 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3212 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3212 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2540 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2540 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2540 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2540 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4884 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4884 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4884 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4884 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3968 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3968 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3968 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 3968 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4820 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4820 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4820 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 4820 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2452 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2452 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2452 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2452 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2424 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2424 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2424 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2424 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 768 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 768 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 768 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 768 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KEAEcAQw.exepid process 4908 KEAEcAQw.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
KEAEcAQw.exepid process 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe 4908 KEAEcAQw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.execmd.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.execmd.execmd.execmd.exe2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.execmd.exedescription pid process target process PID 5008 wrote to memory of 3416 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe ukAYAMUo.exe PID 5008 wrote to memory of 3416 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe ukAYAMUo.exe PID 5008 wrote to memory of 3416 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe ukAYAMUo.exe PID 5008 wrote to memory of 4908 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe KEAEcAQw.exe PID 5008 wrote to memory of 4908 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe KEAEcAQw.exe PID 5008 wrote to memory of 4908 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe KEAEcAQw.exe PID 5008 wrote to memory of 2880 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 5008 wrote to memory of 2880 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 5008 wrote to memory of 2880 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 2880 wrote to memory of 996 2880 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2880 wrote to memory of 996 2880 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2880 wrote to memory of 996 2880 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 5008 wrote to memory of 3592 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 3592 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 3592 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 1624 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 1624 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 1624 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 968 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 968 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 968 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 5008 wrote to memory of 3924 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 5008 wrote to memory of 3924 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 5008 wrote to memory of 3924 5008 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 996 wrote to memory of 804 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 996 wrote to memory of 804 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 996 wrote to memory of 804 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 804 wrote to memory of 2824 804 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 804 wrote to memory of 2824 804 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 804 wrote to memory of 2824 804 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 996 wrote to memory of 2768 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 2768 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 2768 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 4848 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 4848 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 4848 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 1552 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 1552 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 1552 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 996 wrote to memory of 4264 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 996 wrote to memory of 4264 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 996 wrote to memory of 4264 996 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 3924 wrote to memory of 544 3924 cmd.exe cscript.exe PID 3924 wrote to memory of 544 3924 cmd.exe cscript.exe PID 3924 wrote to memory of 544 3924 cmd.exe cscript.exe PID 4264 wrote to memory of 4540 4264 cmd.exe cscript.exe PID 4264 wrote to memory of 4540 4264 cmd.exe cscript.exe PID 4264 wrote to memory of 4540 4264 cmd.exe cscript.exe PID 2824 wrote to memory of 552 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 2824 wrote to memory of 552 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 2824 wrote to memory of 552 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe cmd.exe PID 552 wrote to memory of 2748 552 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 552 wrote to memory of 2748 552 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 552 wrote to memory of 2748 552 cmd.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2824 wrote to memory of 3576 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3576 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3576 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3800 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3800 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3800 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe reg.exe PID 2824 wrote to memory of 3212 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2824 wrote to memory of 3212 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2824 wrote to memory of 3212 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe PID 2824 wrote to memory of 3868 2824 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe Conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\NoQogkwc\ukAYAMUo.exe"C:\Users\Admin\NoQogkwc\ukAYAMUo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\tYMAksos\KEAEcAQw.exe"C:\ProgramData\tYMAksos\KEAEcAQw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵