Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe
-
Size
199KB
-
MD5
978f428348a12660ee885c1f6e34d926
-
SHA1
dd994c28e1df0d4b77972c4c4d796f425e9c446b
-
SHA256
1a5d387ff5859dc880c62a9bc50ee448c464ca998a986d8c1eb93b7c824ed374
-
SHA512
763bcf72b4865e3b285ceacd2385de465a5616f1993aa52b6dd3d786b68a67cbdcb196e8956efe7f49118b8e385fcb14d42ee7dd960c6b5c8caae8eb2b568606
-
SSDEEP
3072:2RTym7D6XCydNyPGfBAz5pttQ6hKztASqbQUbmYtrP/fFVQ1tH0j:2tL7QzfBa5ptJKRASqbQsmYe1tHI
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CYkcEoIA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation CYkcEoIA.exe -
Executes dropped EXE 2 IoCs
Processes:
CYkcEoIA.exeIssYwEQs.exepid process 2056 CYkcEoIA.exe 2720 IssYwEQs.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeCYkcEoIA.exepid process 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeCYkcEoIA.exeIssYwEQs.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IssYwEQs.exe = "C:\\ProgramData\\AMEgsogk\\IssYwEQs.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\CYkcEoIA.exe = "C:\\Users\\Admin\\EwUMYccY\\CYkcEoIA.exe" CYkcEoIA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IssYwEQs.exe = "C:\\ProgramData\\AMEgsogk\\IssYwEQs.exe" IssYwEQs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\EwAQEwMY.exe = "C:\\Users\\Admin\\IsEgIskU\\EwAQEwMY.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QkMMgkgk.exe = "C:\\ProgramData\\wsMEcAko\\QkMMgkgk.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\CYkcEoIA.exe = "C:\\Users\\Admin\\EwUMYccY\\CYkcEoIA.exe" 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1620 2440 WerFault.exe EwAQEwMY.exe 1104 2232 WerFault.exe QkMMgkgk.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1796 reg.exe 2356 reg.exe 2920 reg.exe 1804 reg.exe 1772 reg.exe 828 reg.exe 2528 reg.exe 2660 reg.exe 2008 reg.exe 560 reg.exe 3052 reg.exe 2584 reg.exe 2896 reg.exe 2316 reg.exe 2584 reg.exe 2632 reg.exe 1584 reg.exe 592 reg.exe 1660 reg.exe 1344 reg.exe 888 reg.exe 1616 reg.exe 2664 reg.exe 1736 reg.exe 2868 reg.exe 2860 reg.exe 2576 reg.exe 1456 reg.exe 1608 reg.exe 2796 reg.exe 2932 reg.exe 2664 reg.exe 2772 reg.exe 1828 reg.exe 2464 reg.exe 668 reg.exe 2468 reg.exe 2248 reg.exe 1748 reg.exe 824 reg.exe 2664 reg.exe 948 reg.exe 2304 reg.exe 2452 reg.exe 780 reg.exe 2432 reg.exe 2460 reg.exe 2608 reg.exe 2700 reg.exe 2164 reg.exe 912 reg.exe 2700 reg.exe 1820 reg.exe 1972 reg.exe 2220 reg.exe 2956 reg.exe 2640 reg.exe 900 reg.exe 1396 reg.exe 2696 reg.exe 2792 reg.exe 3004 reg.exe 2672 reg.exe 2668 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exepid process 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2836 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2836 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 308 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 308 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 380 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 380 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1600 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1600 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 336 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 336 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2888 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2888 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2840 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2840 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 856 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 856 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1876 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1876 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1948 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1948 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1396 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1396 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2848 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2848 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2248 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2248 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1664 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1664 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 596 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 596 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 964 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 964 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2656 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2656 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1036 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1036 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2640 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2640 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2456 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1936 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1936 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1808 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1808 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3028 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 3028 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2024 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2024 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2224 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2224 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2252 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2252 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1568 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 1568 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2924 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 2924 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 900 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe 900 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CYkcEoIA.exepid process 2056 CYkcEoIA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
CYkcEoIA.exepid process 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe 2056 CYkcEoIA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.execmd.execmd.exe2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.execmd.execmd.exedescription pid process target process PID 1792 wrote to memory of 2056 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe CYkcEoIA.exe PID 1792 wrote to memory of 2056 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe CYkcEoIA.exe PID 1792 wrote to memory of 2056 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe CYkcEoIA.exe PID 1792 wrote to memory of 2056 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe CYkcEoIA.exe PID 1792 wrote to memory of 2720 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe IssYwEQs.exe PID 1792 wrote to memory of 2720 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe IssYwEQs.exe PID 1792 wrote to memory of 2720 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe IssYwEQs.exe PID 1792 wrote to memory of 2720 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe IssYwEQs.exe PID 1792 wrote to memory of 2780 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2780 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2780 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2780 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2780 wrote to memory of 2672 2780 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2780 wrote to memory of 2672 2780 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2780 wrote to memory of 2672 2780 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2780 wrote to memory of 2672 2780 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 1792 wrote to memory of 2696 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2696 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2696 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2696 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2904 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2904 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2904 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2904 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2700 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2700 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2700 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2700 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 1792 wrote to memory of 2808 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2808 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2808 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1792 wrote to memory of 2808 1792 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2808 wrote to memory of 2612 2808 cmd.exe cscript.exe PID 2808 wrote to memory of 2612 2808 cmd.exe cscript.exe PID 2808 wrote to memory of 2612 2808 cmd.exe cscript.exe PID 2808 wrote to memory of 2612 2808 cmd.exe cscript.exe PID 2672 wrote to memory of 2624 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 2624 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 2624 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 2624 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2624 wrote to memory of 2836 2624 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2624 wrote to memory of 2836 2624 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2624 wrote to memory of 2836 2624 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2624 wrote to memory of 2836 2624 cmd.exe 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe PID 2672 wrote to memory of 2640 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2640 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2640 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2640 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2856 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2856 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2856 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2856 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2872 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2872 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2872 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 2872 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe reg.exe PID 2672 wrote to memory of 1984 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 1984 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 1984 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 2672 wrote to memory of 1984 2672 2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe cmd.exe PID 1984 wrote to memory of 784 1984 cmd.exe cscript.exe PID 1984 wrote to memory of 784 1984 cmd.exe cscript.exe PID 1984 wrote to memory of 784 1984 cmd.exe cscript.exe PID 1984 wrote to memory of 784 1984 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\EwUMYccY\CYkcEoIA.exe"C:\Users\Admin\EwUMYccY\CYkcEoIA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\AMEgsogk\IssYwEQs.exe"C:\ProgramData\AMEgsogk\IssYwEQs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_978f428348a12660ee885c1f6e34d926_virlock241⤵