Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
-
Size
204KB
-
MD5
25d6586cf3cea9c9a3b7c8d4b784edbc
-
SHA1
7e2340a2426c74af6c0639907c151ba9b24676b1
-
SHA256
0f3b66fece3bd62664a4ae3f5996bfa41ef910e75f65a8725903267f4ef85a0e
-
SHA512
373b15720a3769f6e1418f51fdc7b24f0b719b5a15a17d4e1e3a9a7fe2f02e1bc2efa7f6575ee2449dc6a5633d1b9b3518bea8869591224f3827403954eeb486
-
SSDEEP
6144:Uq/GqGiKuik1aB+o4nRo0Rc6rNW+ZM7Rn:U4Gqdj19csS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (60) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wWsccEwI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation wWsccEwI.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 372 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
wWsccEwI.exejkckQYss.exepid process 2316 wWsccEwI.exe 1984 jkckQYss.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exejkckQYss.exepid process 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe 1984 jkckQYss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exejkckQYss.exewWsccEwI.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\wWsccEwI.exe = "C:\\Users\\Admin\\RMAMAgMk\\wWsccEwI.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jkckQYss.exe = "C:\\ProgramData\\rmUUcoEE\\jkckQYss.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jkckQYss.exe = "C:\\ProgramData\\rmUUcoEE\\jkckQYss.exe" jkckQYss.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\wWsccEwI.exe = "C:\\Users\\Admin\\RMAMAgMk\\wWsccEwI.exe" wWsccEwI.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SsMsMEEs.exe = "C:\\Users\\Admin\\JCscUAcI\\SsMsMEEs.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rUwEksMo.exe = "C:\\ProgramData\\yOgwUQwY\\rUwEksMo.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe -
Drops file in Windows directory 1 IoCs
Processes:
jkckQYss.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico jkckQYss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2672 2792 WerFault.exe SsMsMEEs.exe 2524 2600 WerFault.exe rUwEksMo.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2704 reg.exe 2196 reg.exe 2468 reg.exe 2652 reg.exe 2556 reg.exe 1548 reg.exe 3016 reg.exe 2796 reg.exe 1912 reg.exe 1460 reg.exe 2388 reg.exe 2548 reg.exe 1464 reg.exe 2744 reg.exe 1520 reg.exe 2288 reg.exe 1244 reg.exe 2100 reg.exe 2296 reg.exe 1864 reg.exe 2712 reg.exe 292 reg.exe 2324 reg.exe 1708 reg.exe 1712 reg.exe 1980 reg.exe 2644 reg.exe 1716 reg.exe 1516 reg.exe 1920 reg.exe 756 reg.exe 2188 reg.exe 732 reg.exe 1012 reg.exe 876 reg.exe 2952 reg.exe 2392 reg.exe 1500 reg.exe 1272 reg.exe 1936 reg.exe 1328 reg.exe 2216 reg.exe 1276 reg.exe 3028 reg.exe 1624 reg.exe 572 reg.exe 1624 reg.exe 2744 reg.exe 1428 reg.exe 1912 reg.exe 2088 reg.exe 2636 reg.exe 2552 reg.exe 3008 reg.exe 2140 reg.exe 1656 reg.exe 1536 reg.exe 1788 reg.exe 1220 reg.exe 1416 reg.exe 2704 reg.exe 2592 reg.exe 492 reg.exe 996 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exepid process 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1440 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1440 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 532 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 532 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2972 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2972 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2204 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2204 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2576 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2576 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1504 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1504 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2724 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2724 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2288 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2288 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2160 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2160 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2604 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2604 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2820 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2820 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1748 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1748 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 984 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 984 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1696 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1696 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2752 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2752 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2848 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2848 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2724 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2724 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 404 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 404 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2760 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2760 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1520 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1520 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1608 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1608 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1032 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1032 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2880 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2880 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1596 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1596 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 300 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 300 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2788 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2788 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1436 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1436 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wWsccEwI.exepid process 2316 wWsccEwI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
wWsccEwI.exepid process 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe 2316 wWsccEwI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.execmd.execmd.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.execmd.execmd.exedescription pid process target process PID 1368 wrote to memory of 2316 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe wWsccEwI.exe PID 1368 wrote to memory of 2316 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe wWsccEwI.exe PID 1368 wrote to memory of 2316 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe wWsccEwI.exe PID 1368 wrote to memory of 2316 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe wWsccEwI.exe PID 1368 wrote to memory of 1984 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe jkckQYss.exe PID 1368 wrote to memory of 1984 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe jkckQYss.exe PID 1368 wrote to memory of 1984 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe jkckQYss.exe PID 1368 wrote to memory of 1984 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe jkckQYss.exe PID 1368 wrote to memory of 2884 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2884 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2884 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2884 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2884 wrote to memory of 2632 2884 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 2884 wrote to memory of 2632 2884 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 2884 wrote to memory of 2632 2884 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 2884 wrote to memory of 2632 2884 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1368 wrote to memory of 2748 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2748 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2748 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2748 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2868 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2868 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2868 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2868 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2772 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2772 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2772 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2772 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 1368 wrote to memory of 2832 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2832 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2832 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1368 wrote to memory of 2832 1368 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2832 wrote to memory of 2532 2832 cmd.exe cscript.exe PID 2832 wrote to memory of 2532 2832 cmd.exe cscript.exe PID 2832 wrote to memory of 2532 2832 cmd.exe cscript.exe PID 2832 wrote to memory of 2532 2832 cmd.exe cscript.exe PID 2632 wrote to memory of 1796 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1796 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1796 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1796 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1796 wrote to memory of 1440 1796 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1796 wrote to memory of 1440 1796 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1796 wrote to memory of 1440 1796 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1796 wrote to memory of 1440 1796 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 2632 wrote to memory of 1452 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1452 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1452 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1452 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 608 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 608 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 608 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 608 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1416 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1416 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1416 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1416 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 2632 wrote to memory of 1428 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1428 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1428 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2632 wrote to memory of 1428 2632 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1428 wrote to memory of 1592 1428 cmd.exe cscript.exe PID 1428 wrote to memory of 1592 1428 cmd.exe cscript.exe PID 1428 wrote to memory of 1592 1428 cmd.exe cscript.exe PID 1428 wrote to memory of 1592 1428 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\RMAMAgMk\wWsccEwI.exe"C:\Users\Admin\RMAMAgMk\wWsccEwI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\rmUUcoEE\jkckQYss.exe"C:\ProgramData\rmUUcoEE\jkckQYss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock13⤵
- Adds Run key to start application
-
C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 3615⤵
- Program crash
-
C:\ProgramData\yOgwUQwY\rUwEksMo.exe"C:\ProgramData\yOgwUQwY\rUwEksMo.exe"14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 3615⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock65⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock241⤵