Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe
-
Size
193KB
-
MD5
dc4229425e844f005b38928831df7b58
-
SHA1
8a5b8c851a37bea0e0f1e224ae7b630ea29e80b5
-
SHA256
6d8e7697a09363ecf9150887fc5a2084ba84f9fa0600b9ce269323ce5462b61a
-
SHA512
bdce3cc1ddeb3ef3ba9439c2b41369c59715593f8ef41f537098a49a5e8ea9f9175478390d6558d876b7ff8a84b22ec6dce89613c2bd5337fc14517bb3f592b2
-
SSDEEP
6144:zA7Eud7wrDlqjRqHSjU48Lngok43fETVa4y:kd7sxYTqnXchy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (53) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kaEAEQgs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation kaEAEQgs.exe -
Executes dropped EXE 2 IoCs
Processes:
kaEAEQgs.exeUCwEgMko.exepid process 2332 kaEAEQgs.exe 2440 UCwEgMko.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exekaEAEQgs.exepid process 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exekaEAEQgs.exeUCwEgMko.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaEAEQgs.exe = "C:\\Users\\Admin\\kawYIgMI\\kaEAEQgs.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UCwEgMko.exe = "C:\\ProgramData\\pQUkcQoY\\UCwEgMko.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaEAEQgs.exe = "C:\\Users\\Admin\\kawYIgMI\\kaEAEQgs.exe" kaEAEQgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UCwEgMko.exe = "C:\\ProgramData\\pQUkcQoY\\UCwEgMko.exe" UCwEgMko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\sqUoMkUo.exe = "C:\\Users\\Admin\\JAIcUMUw\\sqUoMkUo.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SAQEEEAo.exe = "C:\\ProgramData\\Ucscscog\\SAQEEEAo.exe" 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1152 2500 WerFault.exe sqUoMkUo.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3004 reg.exe 2560 reg.exe 1076 reg.exe 2684 reg.exe 2248 reg.exe 1708 reg.exe 3052 reg.exe 2828 reg.exe 2740 reg.exe 2396 reg.exe 2016 reg.exe 1172 reg.exe 828 reg.exe 2940 reg.exe 2724 reg.exe 1660 reg.exe 2436 reg.exe 3044 reg.exe 2028 reg.exe 2036 reg.exe 1168 reg.exe 1528 reg.exe 2640 reg.exe 2996 reg.exe 2784 reg.exe 1412 reg.exe 1604 reg.exe 1556 reg.exe 2904 reg.exe 2064 reg.exe 556 reg.exe 2928 reg.exe 2768 reg.exe 2632 reg.exe 2364 reg.exe 712 reg.exe 2824 reg.exe 608 reg.exe 828 reg.exe 2768 reg.exe 1248 reg.exe 1820 reg.exe 2644 reg.exe 1744 reg.exe 2388 reg.exe 1168 reg.exe 2948 reg.exe 1244 reg.exe 2304 reg.exe 2780 reg.exe 1172 reg.exe 2556 reg.exe 1688 reg.exe 1632 reg.exe 2576 reg.exe 2504 reg.exe 3000 reg.exe 2368 reg.exe 1744 reg.exe 1668 reg.exe 2624 reg.exe 2028 reg.exe 1360 reg.exe 676 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exepid process 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2132 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2132 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1272 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1272 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 804 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 804 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 624 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 624 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2312 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2312 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2492 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2492 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2016 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2016 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 488 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 488 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 324 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 324 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1232 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1232 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2496 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2496 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2772 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2772 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2892 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2280 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2280 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1036 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1036 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 324 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 324 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2688 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2688 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2808 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2808 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2788 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2788 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2456 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1860 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1860 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 308 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 308 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2512 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2512 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 828 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 828 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1528 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1528 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 676 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 676 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1916 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 1916 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 312 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 312 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2548 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe 2548 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
kaEAEQgs.exepid process 2332 kaEAEQgs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
kaEAEQgs.exepid process 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe 2332 kaEAEQgs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_dc4229425e844f005b38928831df7b58_virlock.execmd.execmd.exe2024-05-24_dc4229425e844f005b38928831df7b58_virlock.execmd.execmd.exedescription pid process target process PID 2400 wrote to memory of 2332 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe kaEAEQgs.exe PID 2400 wrote to memory of 2332 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe kaEAEQgs.exe PID 2400 wrote to memory of 2332 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe kaEAEQgs.exe PID 2400 wrote to memory of 2332 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe kaEAEQgs.exe PID 2400 wrote to memory of 2440 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe UCwEgMko.exe PID 2400 wrote to memory of 2440 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe UCwEgMko.exe PID 2400 wrote to memory of 2440 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe UCwEgMko.exe PID 2400 wrote to memory of 2440 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe UCwEgMko.exe PID 2400 wrote to memory of 2596 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2596 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2596 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2596 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2596 wrote to memory of 2732 2596 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2596 wrote to memory of 2732 2596 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2596 wrote to memory of 2732 2596 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2596 wrote to memory of 2732 2596 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2400 wrote to memory of 2716 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2716 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2716 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2716 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 1764 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 1764 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 1764 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 1764 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2504 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2504 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2504 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2504 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2400 wrote to memory of 2532 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2532 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2532 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2400 wrote to memory of 2532 2400 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2532 wrote to memory of 2544 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2544 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2544 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2544 2532 cmd.exe cscript.exe PID 2732 wrote to memory of 2984 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 2984 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 2984 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 2984 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2984 wrote to memory of 2132 2984 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2984 wrote to memory of 2132 2984 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2984 wrote to memory of 2132 2984 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2984 wrote to memory of 2132 2984 cmd.exe 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe PID 2732 wrote to memory of 1912 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 1912 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 1912 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 1912 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 780 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 780 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 780 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 780 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 2128 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 2128 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 2128 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 2128 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe reg.exe PID 2732 wrote to memory of 1580 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 1580 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 1580 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 2732 wrote to memory of 1580 2732 2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe cmd.exe PID 1580 wrote to memory of 1716 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1716 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1716 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1716 1580 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\kawYIgMI\kaEAEQgs.exe"C:\Users\Admin\kawYIgMI\kaEAEQgs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\pQUkcQoY\UCwEgMko.exe"C:\ProgramData\pQUkcQoY\UCwEgMko.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock109⤵
- Adds Run key to start application
-
C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"110⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 36111⤵
- Program crash
-
C:\ProgramData\Ucscscog\SAQEEEAo.exe"C:\ProgramData\Ucscscog\SAQEEEAo.exe"110⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_dc4229425e844f005b38928831df7b58_virlock241⤵