Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
-
Size
205KB
-
MD5
5ef48f63127987a1df52d23c840bea4a
-
SHA1
2d5073bf30bff3737ad6693fae369a52830e34d1
-
SHA256
9514d108766f1afd9f48bad55acde065e566d02b0ce97ed5366aa1678e328fdb
-
SHA512
a6684415e6b2322acddef1bb0f03c6829a29baff04fedf65ca83cd87521292d666e3969441fe57718fd2350ac1788ac611be67f9e7615bd2d9dbbb8040514985
-
SSDEEP
3072:8X9VAOolOJdYht/RoY64iQDy7cvL3TV06zi/q8ej1wN/jMo+As0164PttTs/wT:8X9CCIt/yl43y7i3TmeO4oI0EOWw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HeEAUsgY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation HeEAUsgY.exe -
Executes dropped EXE 2 IoCs
Processes:
mScEcEww.exeHeEAUsgY.exepid process 4968 mScEcEww.exe 2968 HeEAUsgY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeHeEAUsgY.exemScEcEww.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mScEcEww.exe = "C:\\Users\\Admin\\RGwwEAMM\\mScEcEww.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HeEAUsgY.exe = "C:\\ProgramData\\OIMAokYs\\HeEAUsgY.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HeEAUsgY.exe = "C:\\ProgramData\\OIMAokYs\\HeEAUsgY.exe" HeEAUsgY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mScEcEww.exe = "C:\\Users\\Admin\\RGwwEAMM\\mScEcEww.exe" mScEcEww.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1436 reg.exe 1940 32 reg.exe 1744 reg.exe 3212 reg.exe 3668 reg.exe 1796 reg.exe 2368 1012 reg.exe 2372 reg.exe 2168 reg.exe 3040 reg.exe 5008 reg.exe 2516 reg.exe 2636 reg.exe 4604 reg.exe 1856 reg.exe 4944 reg.exe 2508 3772 reg.exe 2600 reg.exe 4620 reg.exe 3220 reg.exe 1716 reg.exe 3312 reg.exe 608 reg.exe 2692 1240 reg.exe 1120 reg.exe 4940 reg.exe 4256 reg.exe 2064 reg.exe 2368 reg.exe 4044 4904 reg.exe 724 reg.exe 3768 reg.exe 1324 reg.exe 4136 reg.exe 1796 reg.exe 608 reg.exe 1324 reg.exe 1720 reg.exe 4480 reg.exe 3416 reg.exe 2372 reg.exe 4868 reg.exe 1856 reg.exe 5084 reg.exe 1924 reg.exe 4364 reg.exe 2352 reg.exe 4868 2204 reg.exe 3784 reg.exe 4576 reg.exe 3544 reg.exe 4484 reg.exe 264 reg.exe 920 reg.exe 2072 reg.exe 4516 reg.exe 3488 reg.exe 2268 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exepid process 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2448 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2448 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2448 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2448 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4772 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4772 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4772 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4772 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 332 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 332 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 332 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 332 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 3304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2168 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2168 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2168 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2168 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4992 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4992 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4992 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4992 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2544 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2544 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2544 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2544 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4384 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2164 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2164 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2164 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2164 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4844 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4844 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4844 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 4844 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1824 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1824 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1824 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1824 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
HeEAUsgY.exepid process 2968 HeEAUsgY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
HeEAUsgY.exepid process 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe 2968 HeEAUsgY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.execmd.execmd.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.execmd.execmd.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.execmd.exedescription pid process target process PID 2064 wrote to memory of 4968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe mScEcEww.exe PID 2064 wrote to memory of 4968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe mScEcEww.exe PID 2064 wrote to memory of 4968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe mScEcEww.exe PID 2064 wrote to memory of 2968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HeEAUsgY.exe PID 2064 wrote to memory of 2968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HeEAUsgY.exe PID 2064 wrote to memory of 2968 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HeEAUsgY.exe PID 2064 wrote to memory of 4628 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2064 wrote to memory of 4628 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2064 wrote to memory of 4628 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 4628 wrote to memory of 3276 4628 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 4628 wrote to memory of 3276 4628 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 4628 wrote to memory of 3276 4628 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2064 wrote to memory of 2092 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 2092 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 2092 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 1652 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 1652 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 1652 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 4800 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 4800 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 4800 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2064 wrote to memory of 4472 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2064 wrote to memory of 4472 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2064 wrote to memory of 4472 2064 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 4472 wrote to memory of 4568 4472 cmd.exe cscript.exe PID 4472 wrote to memory of 4568 4472 cmd.exe cscript.exe PID 4472 wrote to memory of 4568 4472 cmd.exe cscript.exe PID 3276 wrote to memory of 4364 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 3276 wrote to memory of 4364 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 3276 wrote to memory of 4364 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 4364 wrote to memory of 1944 4364 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 4364 wrote to memory of 1944 4364 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 4364 wrote to memory of 1944 4364 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 3276 wrote to memory of 1012 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 1012 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 1012 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 608 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 608 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 608 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 3356 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 3356 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 3356 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 3276 wrote to memory of 4540 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 3276 wrote to memory of 4540 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 3276 wrote to memory of 4540 3276 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 4540 wrote to memory of 3504 4540 cmd.exe cscript.exe PID 4540 wrote to memory of 3504 4540 cmd.exe cscript.exe PID 4540 wrote to memory of 3504 4540 cmd.exe cscript.exe PID 1944 wrote to memory of 5044 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 1944 wrote to memory of 5044 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 1944 wrote to memory of 5044 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 5044 wrote to memory of 1384 5044 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 5044 wrote to memory of 1384 5044 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 5044 wrote to memory of 1384 5044 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 1944 wrote to memory of 4544 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 4544 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 4544 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 4484 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 4484 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 4484 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 1796 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 1796 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 1796 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 1944 wrote to memory of 1476 1944 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\RGwwEAMM\mScEcEww.exe"C:\Users\Admin\RGwwEAMM\mScEcEww.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\OIMAokYs\HeEAUsgY.exe"C:\ProgramData\OIMAokYs\HeEAUsgY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock241⤵