Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 14:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe
-
Size
207KB
-
MD5
e3c42193dded9876352767a756e25772
-
SHA1
cfb23b31cc2955f593c4ed45a796ea0fb29977cf
-
SHA256
d067c9715106133877f2259a391af73fbd65340d78c6d62af6aa4272fed0478e
-
SHA512
5698e7ef79ab7accf21eaf940f9fb846df7b2ae6e86fb26595b9319addccc150a9343e0328fab37b9ef0f3e9ddf51fb7e7ed60431a9736f9368b314e4ab03a10
-
SSDEEP
3072:9plXxnpZtSqnxbRAHazBjDxAm+NuM2qqk5lt9B+mL/Q5CoW1lDeeXw:zlXxnftrLA6zBjDxGNmwltXJ/Q5obZA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aCEUoUcY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation aCEUoUcY.exe -
Executes dropped EXE 2 IoCs
Processes:
aCEUoUcY.exevCMwQkcE.exepid process 2388 aCEUoUcY.exe 2116 vCMwQkcE.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeaCEUoUcY.exepid process 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeaCEUoUcY.exevCMwQkcE.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\aCEUoUcY.exe = "C:\\Users\\Admin\\BSkAIMkQ\\aCEUoUcY.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vCMwQkcE.exe = "C:\\ProgramData\\aikMwUQE\\vCMwQkcE.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\aCEUoUcY.exe = "C:\\Users\\Admin\\BSkAIMkQ\\aCEUoUcY.exe" aCEUoUcY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vCMwQkcE.exe = "C:\\ProgramData\\aikMwUQE\\vCMwQkcE.exe" vCMwQkcE.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiUAkssw.exe = "C:\\Users\\Admin\\SSsAUQIk\\jiUAkssw.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kkkIogQU.exe = "C:\\ProgramData\\ViAssEMI\\kkkIogQU.exe" 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe -
Drops file in Windows directory 1 IoCs
Processes:
aCEUoUcY.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico aCEUoUcY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2772 2516 WerFault.exe kkkIogQU.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2496 reg.exe 2848 reg.exe 2060 reg.exe 1200 reg.exe 2196 reg.exe 1584 reg.exe 888 reg.exe 2140 reg.exe 2992 reg.exe 1624 reg.exe 1236 reg.exe 2816 reg.exe 1764 reg.exe 2704 reg.exe 2348 reg.exe 2748 reg.exe 2464 reg.exe 2364 reg.exe 1636 reg.exe 1364 reg.exe 2776 reg.exe 2916 reg.exe 2196 reg.exe 2196 reg.exe 2620 reg.exe 2172 reg.exe 896 reg.exe 704 reg.exe 2012 reg.exe 2764 reg.exe 2668 reg.exe 768 reg.exe 2780 reg.exe 1704 reg.exe 2136 reg.exe 604 reg.exe 2936 reg.exe 1828 reg.exe 1552 reg.exe 848 reg.exe 2268 reg.exe 2856 reg.exe 1308 reg.exe 2436 reg.exe 2168 reg.exe 1028 reg.exe 2920 reg.exe 2140 reg.exe 2836 reg.exe 2604 reg.exe 1056 reg.exe 2712 reg.exe 2000 reg.exe 604 reg.exe 1104 reg.exe 1312 reg.exe 2436 reg.exe 2052 reg.exe 1668 reg.exe 1484 reg.exe 2436 reg.exe 2996 reg.exe 1312 reg.exe 2508 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.exepid process 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2940 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2940 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2704 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2704 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2036 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2036 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2432 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2432 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2212 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2212 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2812 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2812 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2584 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2584 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1700 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1700 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1848 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1848 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1676 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1676 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2100 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1832 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1832 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 892 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 892 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 268 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 268 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2820 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2820 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1680 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1680 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1608 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1608 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2632 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2632 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2696 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2696 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2584 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2584 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 780 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 780 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2704 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2704 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1748 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1748 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2768 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2768 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1936 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1936 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2788 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 860 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 780 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 780 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1628 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 1628 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2656 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe 2656 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
aCEUoUcY.exepid process 2388 aCEUoUcY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
aCEUoUcY.exepid process 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe 2388 aCEUoUcY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_e3c42193dded9876352767a756e25772_virlock.execmd.execmd.exe2024-05-24_e3c42193dded9876352767a756e25772_virlock.execmd.execmd.exedescription pid process target process PID 2208 wrote to memory of 2388 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe aCEUoUcY.exe PID 2208 wrote to memory of 2388 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe aCEUoUcY.exe PID 2208 wrote to memory of 2388 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe aCEUoUcY.exe PID 2208 wrote to memory of 2388 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe aCEUoUcY.exe PID 2208 wrote to memory of 2116 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe vCMwQkcE.exe PID 2208 wrote to memory of 2116 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe vCMwQkcE.exe PID 2208 wrote to memory of 2116 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe vCMwQkcE.exe PID 2208 wrote to memory of 2116 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe vCMwQkcE.exe PID 2208 wrote to memory of 2660 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2660 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2660 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2660 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2660 wrote to memory of 2592 2660 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2660 wrote to memory of 2592 2660 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2660 wrote to memory of 2592 2660 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2660 wrote to memory of 2592 2660 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2208 wrote to memory of 2764 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2764 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2764 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2764 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2848 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2848 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2848 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2848 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2620 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2620 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2620 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2620 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2208 wrote to memory of 2800 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2800 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2800 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2208 wrote to memory of 2800 2208 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2800 wrote to memory of 2944 2800 cmd.exe cscript.exe PID 2800 wrote to memory of 2944 2800 cmd.exe cscript.exe PID 2800 wrote to memory of 2944 2800 cmd.exe cscript.exe PID 2800 wrote to memory of 2944 2800 cmd.exe cscript.exe PID 2592 wrote to memory of 2824 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2824 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2824 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2824 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2824 wrote to memory of 2940 2824 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2824 wrote to memory of 2940 2824 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2824 wrote to memory of 2940 2824 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2824 wrote to memory of 2940 2824 cmd.exe 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe PID 2592 wrote to memory of 2996 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2996 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2996 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2996 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2928 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2928 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2928 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2928 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 284 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 284 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 284 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 284 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe reg.exe PID 2592 wrote to memory of 2200 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2200 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2200 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2592 wrote to memory of 2200 2592 2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe cmd.exe PID 2200 wrote to memory of 1700 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 1700 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 1700 2200 cmd.exe cscript.exe PID 2200 wrote to memory of 1700 2200 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\BSkAIMkQ\aCEUoUcY.exe"C:\Users\Admin\BSkAIMkQ\aCEUoUcY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\aikMwUQE\vCMwQkcE.exe"C:\ProgramData\aikMwUQE\vCMwQkcE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock221⤵
- Adds Run key to start application
-
C:\Users\Admin\SSsAUQIk\jiUAkssw.exe"C:\Users\Admin\SSsAUQIk\jiUAkssw.exe"222⤵
-
C:\ProgramData\ViAssEMI\kkkIogQU.exe"C:\ProgramData\ViAssEMI\kkkIogQU.exe"222⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 36223⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_e3c42193dded9876352767a756e25772_virlock241⤵