Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe
-
Size
915KB
-
MD5
545f852cc1f52d76fad52a4f410ba432
-
SHA1
6857449eb58747a188f2b12eeb59655d837df93c
-
SHA256
d39d75fbb6833ccf7c7713b42c85dc9cb8b36c1a3ea8d76514b2431c12a4ddbe
-
SHA512
d1b607b8007d8b77912ca05a95b6bc50e9d2be1e6c4e17b15fd34ad43492af44d1d39763bd4cceca485d592a915892e9a0a2ef8fc2d0b1cb8a63f20e0f843807
-
SSDEEP
12288:ObI8Ciz3ku6SuS2CDgb/zg2XKdVV8GKLJ7Tld6HG/uFxzVlk8ihBhUsKbicv/m+3:pOLkusS2CDM6/V+VGqufpjO01o1eC0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WwwQQAoU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation WwwQQAoU.exe -
Deletes itself 1 IoCs
Processes:
pid process 1868 -
Executes dropped EXE 2 IoCs
Processes:
jYgAwook.exeWwwQQAoU.exepid process 1280 jYgAwook.exe 2920 WwwQQAoU.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeWwwQQAoU.exepid process 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeWwwQQAoU.exejYgAwook.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\jYgAwook.exe = "C:\\Users\\Admin\\TKsUIAUk\\jYgAwook.exe" 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WwwQQAoU.exe = "C:\\ProgramData\\tEcIMskM\\WwwQQAoU.exe" 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WwwQQAoU.exe = "C:\\ProgramData\\tEcIMskM\\WwwQQAoU.exe" WwwQQAoU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\jYgAwook.exe = "C:\\Users\\Admin\\TKsUIAUk\\jYgAwook.exe" jYgAwook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 328 reg.exe 1748 reg.exe 2724 1264 reg.exe 1612 1300 reg.exe 2380 reg.exe 784 reg.exe 2316 reg.exe 576 reg.exe 384 reg.exe 2628 reg.exe 1480 reg.exe 1124 reg.exe 2784 reg.exe 1952 reg.exe 2676 992 reg.exe 1596 reg.exe 1044 reg.exe 1640 reg.exe 1948 reg.exe 2320 reg.exe 2628 reg.exe 704 reg.exe 2408 reg.exe 2204 reg.exe 2336 reg.exe 2748 reg.exe 2728 reg.exe 2628 reg.exe 960 reg.exe 2844 reg.exe 1936 reg.exe 2248 reg.exe 876 reg.exe 2444 reg.exe 1808 reg.exe 2400 reg.exe 1264 reg.exe 2240 reg.exe 2012 reg.exe 1160 reg.exe 1868 reg.exe 1740 reg.exe 2628 reg.exe 1200 reg.exe 1864 reg.exe 2624 reg.exe 2008 reg.exe 1160 reg.exe 1620 reg.exe 496 reg.exe 1964 reg.exe 2292 reg.exe 2932 reg.exe 2772 reg.exe 2620 reg.exe 1796 reg.exe 1612 reg.exe 2028 reg.exe 2112 reg.exe 1676 reg.exe 2428 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exepid process 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1616 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 996 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 996 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2076 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2076 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1044 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1044 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2328 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2328 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2680 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2680 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2580 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2580 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2324 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2324 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2204 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2204 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1124 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1124 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2932 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2932 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 892 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 892 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2744 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2744 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1756 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2044 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2044 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2788 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2788 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1644 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1644 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2596 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2596 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1704 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1704 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2408 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2408 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2864 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2864 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 876 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 876 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 784 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 784 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2412 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2412 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2352 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2352 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1920 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1920 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1092 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 1092 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2116 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2116 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2808 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2808 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2012 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe 2012 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WwwQQAoU.exepid process 2920 WwwQQAoU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
WwwQQAoU.exepid process 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe 2920 WwwQQAoU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.execmd.execmd.exe2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.execmd.execmd.exedescription pid process target process PID 2972 wrote to memory of 1280 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe jYgAwook.exe PID 2972 wrote to memory of 1280 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe jYgAwook.exe PID 2972 wrote to memory of 1280 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe jYgAwook.exe PID 2972 wrote to memory of 1280 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe jYgAwook.exe PID 2972 wrote to memory of 2920 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe WwwQQAoU.exe PID 2972 wrote to memory of 2920 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe WwwQQAoU.exe PID 2972 wrote to memory of 2920 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe WwwQQAoU.exe PID 2972 wrote to memory of 2920 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe WwwQQAoU.exe PID 2972 wrote to memory of 2684 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2684 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2684 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2684 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2684 wrote to memory of 2556 2684 cmd.exe conhost.exe PID 2684 wrote to memory of 2556 2684 cmd.exe conhost.exe PID 2684 wrote to memory of 2556 2684 cmd.exe conhost.exe PID 2684 wrote to memory of 2556 2684 cmd.exe conhost.exe PID 2972 wrote to memory of 2628 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2972 wrote to memory of 2628 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2972 wrote to memory of 2628 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2972 wrote to memory of 2628 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2972 wrote to memory of 1320 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 1320 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 1320 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 1320 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 2544 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2544 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2544 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2544 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2972 wrote to memory of 2464 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 2464 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 2464 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2972 wrote to memory of 2464 2972 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2464 wrote to memory of 2436 2464 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2464 wrote to memory of 2436 2464 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2464 wrote to memory of 2436 2464 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2464 wrote to memory of 2436 2464 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2556 wrote to memory of 2324 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2324 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2324 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2324 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2324 wrote to memory of 1616 2324 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2324 wrote to memory of 1616 2324 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2324 wrote to memory of 1616 2324 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2324 wrote to memory of 1616 2324 cmd.exe 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe PID 2556 wrote to memory of 1220 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 1220 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 1220 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 1220 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 2488 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 2488 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 2488 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 2488 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe reg.exe PID 2556 wrote to memory of 2672 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2672 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2672 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2672 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe conhost.exe PID 2556 wrote to memory of 2200 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2556 wrote to memory of 2200 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2556 wrote to memory of 2200 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2556 wrote to memory of 2200 2556 2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe cmd.exe PID 2200 wrote to memory of 380 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 380 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 380 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 380 2200 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TKsUIAUk\jYgAwook.exe"C:\Users\Admin\TKsUIAUk\jYgAwook.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\tEcIMskM\WwwQQAoU.exe"C:\ProgramData\tEcIMskM\WwwQQAoU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_545f852cc1f52d76fad52a4f410ba432_virlock241⤵