Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 13:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe
-
Size
268KB
-
MD5
5b3e104a28b0fe470b49d27e6fd466de
-
SHA1
21081cd1114148f53787375dbbf23b15bec2fbc8
-
SHA256
e03f859ec2b9ae57590beb8d1acb4225b819e445ac638243e566f7a0466788cf
-
SHA512
1765e99245312028831d496e890ca68c8906651a355d6304408ab1e39d812ded00e0ace00b665de7b81eaba89a570c12e88bb7e9bd3def234b209cbe4f10403e
-
SSDEEP
3072:AolMtIr0rbOKsZM3XjcuvzrEtLWeCbMO72UVAFaZ15M9BZUHdZK1yBbEpCI3BaUx:Ao+uwDFBwWeCZ7H7ZY9cy1Ib/vQnF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jSEwwgIM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation jSEwwgIM.exe -
Executes dropped EXE 2 IoCs
Processes:
jSEwwgIM.exelkwwwIwk.exepid process 2096 jSEwwgIM.exe 1888 lkwwwIwk.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exejSEwwgIM.exepid process 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exejSEwwgIM.exelkwwwIwk.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lkwwwIwk.exe = "C:\\ProgramData\\WWwAYcEo\\lkwwwIwk.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\jSEwwgIM.exe = "C:\\Users\\Admin\\SmIsIYoU\\jSEwwgIM.exe" jSEwwgIM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lkwwwIwk.exe = "C:\\ProgramData\\WWwAYcEo\\lkwwwIwk.exe" lkwwwIwk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\QmYkMAUk.exe = "C:\\Users\\Admin\\wwkAEgoU\\QmYkMAUk.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suYIIMok.exe = "C:\\ProgramData\\dKsEgkks\\suYIIMok.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\jSEwwgIM.exe = "C:\\Users\\Admin\\SmIsIYoU\\jSEwwgIM.exe" 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe -
Drops file in Windows directory 1 IoCs
Processes:
jSEwwgIM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico jSEwwgIM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2972 1216 WerFault.exe QmYkMAUk.exe 1092 848 WerFault.exe suYIIMok.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 796 reg.exe 1644 reg.exe 2856 reg.exe 2692 reg.exe 1592 reg.exe 2760 reg.exe 2980 reg.exe 2428 reg.exe 1152 reg.exe 3000 reg.exe 1908 reg.exe 920 reg.exe 2520 reg.exe 2420 reg.exe 2268 reg.exe 1580 reg.exe 856 reg.exe 3000 reg.exe 1272 reg.exe 1104 reg.exe 2712 reg.exe 1116 reg.exe 2016 reg.exe 3000 reg.exe 2532 reg.exe 1948 reg.exe 2676 reg.exe 2560 reg.exe 1456 reg.exe 2988 reg.exe 2672 reg.exe 1716 reg.exe 1892 reg.exe 1204 reg.exe 1284 reg.exe 2788 reg.exe 3056 reg.exe 2976 reg.exe 3000 reg.exe 2904 reg.exe 948 reg.exe 2116 reg.exe 1836 reg.exe 1876 reg.exe 2924 reg.exe 2712 reg.exe 988 reg.exe 2936 reg.exe 2420 reg.exe 1988 reg.exe 2812 reg.exe 2736 reg.exe 2880 reg.exe 3020 reg.exe 3056 reg.exe 2296 reg.exe 2372 reg.exe 2708 reg.exe 412 reg.exe 2320 reg.exe 1676 reg.exe 2268 reg.exe 2060 reg.exe 800 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exepid process 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1200 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1200 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2216 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2216 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1476 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1476 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 764 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2940 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2940 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2616 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2616 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2588 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2588 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1480 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1480 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 452 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 452 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2932 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2932 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 992 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 992 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2796 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2796 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 320 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 320 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2572 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2572 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2176 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2176 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2064 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2064 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1880 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1880 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2464 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2464 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2736 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2736 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2320 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2320 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2724 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2724 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2420 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2420 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2272 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2272 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1880 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 1880 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2372 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2372 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2936 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2936 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2400 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2400 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2856 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2856 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2088 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2088 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2712 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe 2712 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
jSEwwgIM.exepid process 2096 jSEwwgIM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
jSEwwgIM.exepid process 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe 2096 jSEwwgIM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.execmd.execmd.exe2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.execmd.execmd.exedescription pid process target process PID 1160 wrote to memory of 2096 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe jSEwwgIM.exe PID 1160 wrote to memory of 2096 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe jSEwwgIM.exe PID 1160 wrote to memory of 2096 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe jSEwwgIM.exe PID 1160 wrote to memory of 2096 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe jSEwwgIM.exe PID 1160 wrote to memory of 1888 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe lkwwwIwk.exe PID 1160 wrote to memory of 1888 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe lkwwwIwk.exe PID 1160 wrote to memory of 1888 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe lkwwwIwk.exe PID 1160 wrote to memory of 1888 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe lkwwwIwk.exe PID 1160 wrote to memory of 2588 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2588 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2588 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2588 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2588 wrote to memory of 2704 2588 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2588 wrote to memory of 2704 2588 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2588 wrote to memory of 2704 2588 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2588 wrote to memory of 2704 2588 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 1160 wrote to memory of 2728 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2728 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2728 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2728 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2692 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2692 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2692 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2692 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2568 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2568 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2568 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2568 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 1160 wrote to memory of 2468 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2468 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2468 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 1160 wrote to memory of 2468 1160 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2468 wrote to memory of 2444 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2444 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2444 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2444 2468 cmd.exe cscript.exe PID 2704 wrote to memory of 2192 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 2192 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 2192 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 2192 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2192 wrote to memory of 1200 2192 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2192 wrote to memory of 1200 2192 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2192 wrote to memory of 1200 2192 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2192 wrote to memory of 1200 2192 cmd.exe 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe PID 2704 wrote to memory of 2644 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2644 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2644 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2644 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 1640 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 1640 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 1640 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 1640 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2404 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2404 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2404 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 2404 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe reg.exe PID 2704 wrote to memory of 836 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 836 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 836 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 2704 wrote to memory of 836 2704 2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe cmd.exe PID 836 wrote to memory of 2328 836 cmd.exe cscript.exe PID 836 wrote to memory of 2328 836 cmd.exe cscript.exe PID 836 wrote to memory of 2328 836 cmd.exe cscript.exe PID 836 wrote to memory of 2328 836 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SmIsIYoU\jSEwwgIM.exe"C:\Users\Admin\SmIsIYoU\jSEwwgIM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\WWwAYcEo\lkwwwIwk.exe"C:\ProgramData\WWwAYcEo\lkwwwIwk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock125⤵
- Adds Run key to start application
-
C:\Users\Admin\wwkAEgoU\QmYkMAUk.exe"C:\Users\Admin\wwkAEgoU\QmYkMAUk.exe"126⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 36127⤵
- Program crash
-
C:\ProgramData\dKsEgkks\suYIIMok.exe"C:\ProgramData\dKsEgkks\suYIIMok.exe"126⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 36127⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_5b3e104a28b0fe470b49d27e6fd466de_virlock241⤵