Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 13:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe
-
Size
190KB
-
MD5
6e9f6eeb64bbf4811875e387d539594c
-
SHA1
9572b46f4ae05e2aa622f4bfbf9cda6669f9406e
-
SHA256
a30b0c083b8943dd3decaa1060781eca029e425cbb13515505508273bc86de09
-
SHA512
63511bf2430eb766ed1e2444db97dec329477103e6cb3efab1685731203393da069fcbb86f164a834fcd06f25a5871cdaa4c79a614812b030f68b6c282bdc397
-
SSDEEP
3072:lIhcy1CpPxuC+VpNpxXbrIhrniL4LGXlmJ22CWE+i9mZwipq9ML22cr8ml+65fT3:lVywpPQC+VpNpCrnsA7cr3dTgC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hOkwMwEo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\International\Geo\Nation hOkwMwEo.exe -
Executes dropped EXE 2 IoCs
Processes:
hOkwMwEo.exeMkEcsQMU.exepid process 2972 hOkwMwEo.exe 2616 MkEcsQMU.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exehOkwMwEo.exepid process 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exehOkwMwEo.exeMkEcsQMU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\hOkwMwEo.exe = "C:\\Users\\Admin\\OeUAEYgY\\hOkwMwEo.exe" 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MkEcsQMU.exe = "C:\\ProgramData\\xkYwQEEI\\MkEcsQMU.exe" 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\hOkwMwEo.exe = "C:\\Users\\Admin\\OeUAEYgY\\hOkwMwEo.exe" hOkwMwEo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MkEcsQMU.exe = "C:\\ProgramData\\xkYwQEEI\\MkEcsQMU.exe" MkEcsQMU.exe -
Drops file in Windows directory 1 IoCs
Processes:
hOkwMwEo.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico hOkwMwEo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2504 reg.exe 1868 reg.exe 1440 reg.exe 2536 reg.exe 1612 reg.exe 592 reg.exe 2692 reg.exe 2276 reg.exe 2628 reg.exe 788 reg.exe 2704 reg.exe 2124 reg.exe 1560 reg.exe 2744 reg.exe 1212 reg.exe 2156 reg.exe 1512 reg.exe 112 reg.exe 3064 reg.exe 632 reg.exe 2552 reg.exe 2396 reg.exe 2752 reg.exe 1636 reg.exe 1160 reg.exe 1096 reg.exe 932 reg.exe 296 reg.exe 2068 reg.exe 1440 reg.exe 2504 reg.exe 2820 reg.exe 2940 reg.exe 2300 reg.exe 2980 reg.exe 1464 reg.exe 412 reg.exe 2416 reg.exe 1420 reg.exe 2780 reg.exe 1548 reg.exe 2080 reg.exe 1160 reg.exe 1748 reg.exe 1684 reg.exe 2492 reg.exe 2500 reg.exe 2896 reg.exe 1948 reg.exe 2584 reg.exe 324 reg.exe 2468 reg.exe 2916 reg.exe 1980 reg.exe 2588 reg.exe 1600 reg.exe 3024 reg.exe 2724 reg.exe 2144 reg.exe 1740 reg.exe 1364 reg.exe 2076 reg.exe 2452 reg.exe 2576 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exepid process 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2172 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2172 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2320 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2320 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2924 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2924 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1144 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 796 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 796 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2736 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2736 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3008 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3008 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2508 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2508 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 284 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 284 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2016 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2016 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2260 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2260 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 796 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 796 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2448 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2448 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3008 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 3008 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1624 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1624 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 828 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 828 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1160 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1160 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1000 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1000 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2424 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2424 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2132 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2132 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1364 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1364 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 764 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 764 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2276 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2276 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1996 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1996 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1744 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1744 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1072 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1072 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1060 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 1060 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2348 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2348 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2572 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe 2572 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
hOkwMwEo.exepid process 2972 hOkwMwEo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
hOkwMwEo.exepid process 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe 2972 hOkwMwEo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.execmd.execmd.exe2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.execmd.execmd.exedescription pid process target process PID 844 wrote to memory of 2972 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe hOkwMwEo.exe PID 844 wrote to memory of 2972 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe hOkwMwEo.exe PID 844 wrote to memory of 2972 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe hOkwMwEo.exe PID 844 wrote to memory of 2972 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe hOkwMwEo.exe PID 844 wrote to memory of 2616 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe MkEcsQMU.exe PID 844 wrote to memory of 2616 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe MkEcsQMU.exe PID 844 wrote to memory of 2616 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe MkEcsQMU.exe PID 844 wrote to memory of 2616 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe MkEcsQMU.exe PID 844 wrote to memory of 2632 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2632 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2632 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2632 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2632 wrote to memory of 2592 2632 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2632 wrote to memory of 2592 2632 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2632 wrote to memory of 2592 2632 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2632 wrote to memory of 2592 2632 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 844 wrote to memory of 2920 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2920 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2920 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2920 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2572 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2572 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2572 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2572 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2032 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2032 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2032 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2032 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 844 wrote to memory of 2648 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2648 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2648 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 844 wrote to memory of 2648 844 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2648 wrote to memory of 2492 2648 cmd.exe cscript.exe PID 2648 wrote to memory of 2492 2648 cmd.exe cscript.exe PID 2648 wrote to memory of 2492 2648 cmd.exe cscript.exe PID 2648 wrote to memory of 2492 2648 cmd.exe cscript.exe PID 2592 wrote to memory of 2512 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2512 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2512 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2512 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2512 wrote to memory of 2172 2512 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2512 wrote to memory of 2172 2512 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2512 wrote to memory of 2172 2512 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2512 wrote to memory of 2172 2512 cmd.exe 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe PID 2592 wrote to memory of 2884 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2884 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2884 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2884 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2980 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2980 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2980 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2980 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 3024 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 3024 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 3024 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 3024 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe reg.exe PID 2592 wrote to memory of 2816 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2816 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2816 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2592 wrote to memory of 2816 2592 2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe cmd.exe PID 2816 wrote to memory of 1464 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 1464 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 1464 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 1464 2816 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\OeUAEYgY\hOkwMwEo.exe"C:\Users\Admin\OeUAEYgY\hOkwMwEo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\xkYwQEEI\MkEcsQMU.exe"C:\ProgramData\xkYwQEEI\MkEcsQMU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_6e9f6eeb64bbf4811875e387d539594c_virlock241⤵