Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
-
Size
268KB
-
MD5
156c0c82cc6ec79b5e510a32ffb4c320
-
SHA1
3fba51da6a341e3d4d75342de7bf0765e2fe5fed
-
SHA256
80363080de8ff10d5702532b3e1cb112b848f12cb21608fc4868cc2ae8a1303a
-
SHA512
8d636830f305bba2c35b863a8138ac946be8f1278344c22c207fc1bb25391d13024379e7cca98c4848831be54de2ad05432d1cbf725e408db4cee9a2a2e76b58
-
SSDEEP
6144:fI5amBA/dOi5QBF12xiBS8HP3MHlqngE:g5XB8D5QBF1fU8HfMFqgE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
KOUsQkMI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation KOUsQkMI.exe -
Executes dropped EXE 2 IoCs
Processes:
KOUsQkMI.exeqckIEEUs.exepid process 2248 KOUsQkMI.exe 2484 qckIEEUs.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeKOUsQkMI.exepid process 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeKOUsQkMI.exeqckIEEUs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qckIEEUs.exe = "C:\\ProgramData\\FYkQoUwk\\qckIEEUs.exe" 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\KOUsQkMI.exe = "C:\\Users\\Admin\\VoQEcMEk\\KOUsQkMI.exe" KOUsQkMI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qckIEEUs.exe = "C:\\ProgramData\\FYkQoUwk\\qckIEEUs.exe" qckIEEUs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\KOUsQkMI.exe = "C:\\Users\\Admin\\VoQEcMEk\\KOUsQkMI.exe" 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 888 reg.exe 108 reg.exe 112 reg.exe 1148 reg.exe 1476 reg.exe 1240 reg.exe 2260 reg.exe 1740 reg.exe 2384 reg.exe 1796 reg.exe 3020 reg.exe 1240 reg.exe 2600 reg.exe 1652 reg.exe 944 reg.exe 2568 reg.exe 688 reg.exe 2260 reg.exe 1948 reg.exe 2932 reg.exe 2868 reg.exe 3036 reg.exe 2156 reg.exe 1924 reg.exe 2260 reg.exe 1928 reg.exe 2316 reg.exe 2056 reg.exe 284 reg.exe 1884 reg.exe 2204 reg.exe 396 reg.exe 2716 reg.exe 2872 reg.exe 536 reg.exe 1652 reg.exe 2284 reg.exe 656 reg.exe 2380 reg.exe 2300 reg.exe 2496 reg.exe 2188 reg.exe 2268 reg.exe 1616 reg.exe 2432 reg.exe 2376 reg.exe 2744 reg.exe 2600 reg.exe 2448 reg.exe 2504 reg.exe 2476 reg.exe 872 reg.exe 2716 reg.exe 2480 reg.exe 1904 reg.exe 2388 reg.exe 584 reg.exe 1460 reg.exe 1624 reg.exe 560 reg.exe 2252 reg.exe 2876 reg.exe 2368 reg.exe 1484 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exepid process 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2652 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2652 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2768 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2768 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1784 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1784 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 948 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 948 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2512 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2512 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2648 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2648 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1452 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1452 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1968 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1968 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 668 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 668 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 948 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 948 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2976 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2976 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 804 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 804 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2068 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2068 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2020 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2020 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2016 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2016 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1528 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1528 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2424 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2424 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2660 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2660 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 912 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 912 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1240 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1240 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2316 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2316 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1532 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1532 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2512 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2512 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1436 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1436 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2292 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2292 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2728 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2728 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1180 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1180 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1852 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1852 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KOUsQkMI.exepid process 2248 KOUsQkMI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
KOUsQkMI.exepid process 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe 2248 KOUsQkMI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.execmd.execmd.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.execmd.execmd.exedescription pid process target process PID 1620 wrote to memory of 2248 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe KOUsQkMI.exe PID 1620 wrote to memory of 2248 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe KOUsQkMI.exe PID 1620 wrote to memory of 2248 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe KOUsQkMI.exe PID 1620 wrote to memory of 2248 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe KOUsQkMI.exe PID 1620 wrote to memory of 2484 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe qckIEEUs.exe PID 1620 wrote to memory of 2484 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe qckIEEUs.exe PID 1620 wrote to memory of 2484 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe qckIEEUs.exe PID 1620 wrote to memory of 2484 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe qckIEEUs.exe PID 1620 wrote to memory of 2788 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2788 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2788 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2788 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 2788 wrote to memory of 1208 2788 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2788 wrote to memory of 1208 2788 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2788 wrote to memory of 1208 2788 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2788 wrote to memory of 1208 2788 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 1620 wrote to memory of 1652 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 1652 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 1652 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 1652 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2416 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2416 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2416 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2416 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2408 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2408 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2408 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2408 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1620 wrote to memory of 2692 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2692 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2692 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1620 wrote to memory of 2692 1620 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 2692 wrote to memory of 2868 2692 cmd.exe cscript.exe PID 2692 wrote to memory of 2868 2692 cmd.exe cscript.exe PID 2692 wrote to memory of 2868 2692 cmd.exe cscript.exe PID 2692 wrote to memory of 2868 2692 cmd.exe cscript.exe PID 1208 wrote to memory of 2684 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 2684 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 2684 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 2684 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 2684 wrote to memory of 2652 2684 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2684 wrote to memory of 2652 2684 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2684 wrote to memory of 2652 2684 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 2684 wrote to memory of 2652 2684 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 1208 wrote to memory of 1444 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 1444 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 1444 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 1444 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 2260 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 2260 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 2260 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 2260 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 396 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 396 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 396 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 396 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1208 wrote to memory of 1644 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 1644 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 1644 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1208 wrote to memory of 1644 1208 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1644 wrote to memory of 1540 1644 cmd.exe cscript.exe PID 1644 wrote to memory of 1540 1644 cmd.exe cscript.exe PID 1644 wrote to memory of 1540 1644 cmd.exe cscript.exe PID 1644 wrote to memory of 1540 1644 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\VoQEcMEk\KOUsQkMI.exe"C:\Users\Admin\VoQEcMEk\KOUsQkMI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\FYkQoUwk\qckIEEUs.exe"C:\ProgramData\FYkQoUwk\qckIEEUs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock241⤵