Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 03:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
-
Size
190KB
-
MD5
213e54e8e0cfc370f9c7839facb48323
-
SHA1
a4eb90787752567f1f9b63e8df6ffecc758a59f9
-
SHA256
69aeaec4d5c9e024ff15234ae8bc5aaf97b98f410e364fc5109a7c1c36f0a168
-
SHA512
85795f86660741063465ba2b94f212dae3a97962df07ef995e9f62ce555cd32a7bef8d5c4702db12f608cf0b8c70608b6db582fc8826dfd5f071dcb7419a0fc8
-
SSDEEP
3072:eozsn4c3TJZKPMmymb6fZKnzH5zhRstsx8PhAJbPBgyjgpKa+P5cIBrVZazvn6R:nY4c3TmPM5mtvRosePgbPBTuJ+P5JJ/n
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sUIQkAwE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation sUIQkAwE.exe -
Executes dropped EXE 2 IoCs
Processes:
sUIQkAwE.exeWGsskQYE.exepid process 2372 sUIQkAwE.exe 4616 WGsskQYE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exesUIQkAwE.exeWGsskQYE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sUIQkAwE.exe = "C:\\Users\\Admin\\lCwsksAE\\sUIQkAwE.exe" 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WGsskQYE.exe = "C:\\ProgramData\\lgYgAEcc\\WGsskQYE.exe" 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sUIQkAwE.exe = "C:\\Users\\Admin\\lCwsksAE\\sUIQkAwE.exe" sUIQkAwE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WGsskQYE.exe = "C:\\ProgramData\\lgYgAEcc\\WGsskQYE.exe" WGsskQYE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 404 reg.exe 3068 reg.exe 3552 reg.exe 1412 reg.exe 5060 reg.exe 2780 reg.exe 3568 3584 reg.exe 4044 reg.exe 2144 reg.exe 1800 reg.exe 1912 reg.exe 5088 reg.exe 2216 reg.exe 1212 reg.exe 3116 reg.exe 3240 reg.exe 3020 1124 1916 reg.exe 5036 reg.exe 1480 reg.exe 1828 reg.exe 3792 reg.exe 824 reg.exe 2136 reg.exe 2512 reg.exe 4960 reg.exe 4856 reg.exe 212 reg.exe 3832 reg.exe 3884 reg.exe 2772 reg.exe 1332 reg.exe 3116 reg.exe 3080 reg.exe 860 reg.exe 3300 reg.exe 4604 3056 reg.exe 4608 reg.exe 4292 reg.exe 3036 2188 reg.exe 1012 reg.exe 740 reg.exe 4292 reg.exe 3344 reg.exe 1692 reg.exe 3448 5044 reg.exe 1996 reg.exe 2124 reg.exe 5036 reg.exe 1828 reg.exe 4800 reg.exe 2376 reg.exe 408 reg.exe 2212 reg.exe 3280 reg.exe 3052 reg.exe 996 reg.exe 4352 2796 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exepid process 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1800 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1800 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1800 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1800 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2844 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2844 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2844 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2844 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3988 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3988 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3988 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 3988 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1264 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1264 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1264 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1264 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 972 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 972 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 972 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 972 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4288 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4288 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4288 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4288 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2664 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2664 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2664 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2664 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1092 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1092 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1092 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1092 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 4460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2812 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2812 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2812 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2812 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
sUIQkAwE.exepid process 2372 sUIQkAwE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
sUIQkAwE.exepid process 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe 2372 sUIQkAwE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.execmd.execmd.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.execmd.execmd.exe2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.execmd.exedescription pid process target process PID 3364 wrote to memory of 2372 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe sUIQkAwE.exe PID 3364 wrote to memory of 2372 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe sUIQkAwE.exe PID 3364 wrote to memory of 2372 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe sUIQkAwE.exe PID 3364 wrote to memory of 4616 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe WGsskQYE.exe PID 3364 wrote to memory of 4616 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe WGsskQYE.exe PID 3364 wrote to memory of 4616 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe WGsskQYE.exe PID 3364 wrote to memory of 3828 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 3364 wrote to memory of 3828 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 3364 wrote to memory of 3828 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 3364 wrote to memory of 3552 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3552 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3552 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3036 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3036 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3036 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3584 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3584 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 3584 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 3364 wrote to memory of 4960 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 3364 wrote to memory of 4960 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 3364 wrote to memory of 4960 3364 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4960 wrote to memory of 4912 4960 cmd.exe cscript.exe PID 4960 wrote to memory of 4912 4960 cmd.exe cscript.exe PID 4960 wrote to memory of 4912 4960 cmd.exe cscript.exe PID 3828 wrote to memory of 4896 3828 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 3828 wrote to memory of 4896 3828 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 3828 wrote to memory of 4896 3828 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 4896 wrote to memory of 4848 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4896 wrote to memory of 4848 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4896 wrote to memory of 4848 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4848 wrote to memory of 4500 4848 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 4848 wrote to memory of 4500 4848 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 4848 wrote to memory of 4500 4848 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 4896 wrote to memory of 4808 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 4808 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 4808 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 1996 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 1996 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 1996 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 5076 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 5076 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 5076 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4896 wrote to memory of 2472 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4896 wrote to memory of 2472 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4896 wrote to memory of 2472 4896 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 2472 wrote to memory of 3912 2472 cmd.exe cscript.exe PID 2472 wrote to memory of 3912 2472 cmd.exe cscript.exe PID 2472 wrote to memory of 3912 2472 cmd.exe cscript.exe PID 4500 wrote to memory of 1820 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4500 wrote to memory of 1820 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 4500 wrote to memory of 1820 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe PID 1820 wrote to memory of 4704 1820 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 1820 wrote to memory of 4704 1820 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 1820 wrote to memory of 4704 1820 cmd.exe 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe PID 4500 wrote to memory of 1624 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1624 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1624 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1192 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1192 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1192 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1212 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1212 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 1212 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe reg.exe PID 4500 wrote to memory of 3116 4500 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\lCwsksAE\sUIQkAwE.exe"C:\Users\Admin\lCwsksAE\sUIQkAwE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\lgYgAEcc\WGsskQYE.exe"C:\ProgramData\lgYgAEcc\WGsskQYE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵