Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
-
Size
207KB
-
MD5
17b82e64e80caab520aac1965ba4f8cb
-
SHA1
2e4a23c270b3e8d9324a7192f07f405ef03bea59
-
SHA256
a376ad480944f8a6e3dd1fe3a260a9d6196b88010a91e1af0883d2f44bc29784
-
SHA512
e882a59ea0feaa556a303e7857f04f1415216509658ed5888c2e61b4de5f136e4cfe4f09e8e54ecee42abadec53431520aa3646401df400e87f2cace67eab3a7
-
SSDEEP
3072:+xeV4f7Gdz24bTZ6OoaqGGY6wzOKbghx0O8CLLpK6LC0Pybl:KeVwQiq9epwR0b5K67P4l
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (64) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FMMMgsQM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation FMMMgsQM.exe -
Executes dropped EXE 2 IoCs
Processes:
FMMMgsQM.exePosQkwsI.exepid process 316 FMMMgsQM.exe 2248 PosQkwsI.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeFMMMgsQM.exepid process 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeFMMMgsQM.exePosQkwsI.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\FMMMgsQM.exe = "C:\\Users\\Admin\\LkAsccMs\\FMMMgsQM.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PosQkwsI.exe = "C:\\ProgramData\\ecooUYII\\PosQkwsI.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\FMMMgsQM.exe = "C:\\Users\\Admin\\LkAsccMs\\FMMMgsQM.exe" FMMMgsQM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PosQkwsI.exe = "C:\\ProgramData\\ecooUYII\\PosQkwsI.exe" PosQkwsI.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SsMsMEEs.exe = "C:\\Users\\Admin\\JCscUAcI\\SsMsMEEs.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rUwEksMo.exe = "C:\\ProgramData\\yOgwUQwY\\rUwEksMo.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe -
Drops file in Windows directory 1 IoCs
Processes:
FMMMgsQM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico FMMMgsQM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2648 2608 WerFault.exe SsMsMEEs.exe 2196 2540 WerFault.exe rUwEksMo.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1644 reg.exe 2260 reg.exe 2984 reg.exe 1336 reg.exe 2620 reg.exe 1144 reg.exe 352 reg.exe 1948 reg.exe 1576 reg.exe 2196 reg.exe 2740 reg.exe 1064 reg.exe 2332 reg.exe 772 reg.exe 1600 reg.exe 1324 reg.exe 2852 reg.exe 2696 reg.exe 1028 reg.exe 1428 reg.exe 2860 reg.exe 828 reg.exe 1596 reg.exe 1604 reg.exe 1836 reg.exe 1568 reg.exe 3052 reg.exe 2604 reg.exe 2064 reg.exe 2200 reg.exe 2420 reg.exe 2600 reg.exe 1644 reg.exe 344 reg.exe 880 reg.exe 1068 reg.exe 1344 reg.exe 2412 reg.exe 2284 reg.exe 2716 reg.exe 2032 reg.exe 1756 reg.exe 2976 reg.exe 2924 reg.exe 2300 reg.exe 2628 reg.exe 2996 reg.exe 2396 reg.exe 2092 reg.exe 660 reg.exe 868 reg.exe 2700 reg.exe 1040 reg.exe 1336 reg.exe 2836 reg.exe 2952 reg.exe 1416 reg.exe 2076 reg.exe 2036 reg.exe 2332 reg.exe 2116 reg.exe 2316 reg.exe 2224 reg.exe 2616 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exepid process 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2604 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2604 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2876 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2876 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2132 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2132 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1064 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1064 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2596 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2596 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2520 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2520 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2332 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2332 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2064 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2064 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2832 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2832 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2864 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2864 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 492 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 492 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1748 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1748 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2552 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2552 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2004 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2004 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1344 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1344 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1844 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1844 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2800 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2800 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3004 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3004 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2660 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2660 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1668 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1668 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 532 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 532 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1604 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1604 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2288 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2288 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3048 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3048 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2128 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2128 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1900 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1900 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1600 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1600 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2736 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2736 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
FMMMgsQM.exepid process 316 FMMMgsQM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
FMMMgsQM.exepid process 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe 316 FMMMgsQM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.execmd.execmd.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.execmd.execmd.exedescription pid process target process PID 2184 wrote to memory of 316 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe FMMMgsQM.exe PID 2184 wrote to memory of 316 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe FMMMgsQM.exe PID 2184 wrote to memory of 316 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe FMMMgsQM.exe PID 2184 wrote to memory of 316 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe FMMMgsQM.exe PID 2184 wrote to memory of 2248 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PosQkwsI.exe PID 2184 wrote to memory of 2248 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PosQkwsI.exe PID 2184 wrote to memory of 2248 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PosQkwsI.exe PID 2184 wrote to memory of 2248 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PosQkwsI.exe PID 2184 wrote to memory of 2624 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2624 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2624 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2624 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2624 wrote to memory of 2716 2624 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2624 wrote to memory of 2716 2624 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2624 wrote to memory of 2716 2624 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2624 wrote to memory of 2716 2624 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2184 wrote to memory of 2912 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2912 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2912 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2912 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 832 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 832 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 832 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 832 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2672 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2672 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2672 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2672 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2184 wrote to memory of 2896 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2896 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2896 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2184 wrote to memory of 2896 2184 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2896 wrote to memory of 2512 2896 cmd.exe cscript.exe PID 2896 wrote to memory of 2512 2896 cmd.exe cscript.exe PID 2896 wrote to memory of 2512 2896 cmd.exe cscript.exe PID 2896 wrote to memory of 2512 2896 cmd.exe cscript.exe PID 2716 wrote to memory of 3008 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 3008 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 3008 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 3008 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 3008 wrote to memory of 2604 3008 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 3008 wrote to memory of 2604 3008 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 3008 wrote to memory of 2604 3008 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 3008 wrote to memory of 2604 3008 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2716 wrote to memory of 3052 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 3052 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 3052 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 3052 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2552 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2552 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2552 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2552 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2396 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2396 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2396 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2396 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2716 wrote to memory of 2060 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 2060 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 2060 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2716 wrote to memory of 2060 2716 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2060 wrote to memory of 1320 2060 cmd.exe cscript.exe PID 2060 wrote to memory of 1320 2060 cmd.exe cscript.exe PID 2060 wrote to memory of 1320 2060 cmd.exe cscript.exe PID 2060 wrote to memory of 1320 2060 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\LkAsccMs\FMMMgsQM.exe"C:\Users\Admin\LkAsccMs\FMMMgsQM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\ecooUYII\PosQkwsI.exe"C:\ProgramData\ecooUYII\PosQkwsI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock123⤵
- Adds Run key to start application
-
C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"124⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 36125⤵
- Program crash
-
C:\ProgramData\yOgwUQwY\rUwEksMo.exe"C:\ProgramData\yOgwUQwY\rUwEksMo.exe"124⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36125⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock241⤵