Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 11:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe
-
Size
187KB
-
MD5
7a8c3761bddf48493b1c70a2c7c0edf8
-
SHA1
4dbc881e89776f6673c0fafbb09793cc85aaf4f3
-
SHA256
41b2e1b3bf6631b760c9a750fefc44e71d9dcbf90d333f7c04a9ebdd38c4485a
-
SHA512
3524cb3525ef3d0881256065c4035ff200b0b4e9f12d183078beeccc584eaec24d69db4ad1e9d1086b7e0a490311a7cde7a02c076e5d77b48a3f822044facca7
-
SSDEEP
3072:cJRmXoYlhBOxAbektPNIWlNW1i4V7LdWXxY2C0UErEOtlV2UmDWAkVSKLlk43QbW:c7slhBOxAbekYWTWlL9UKPztbsF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
buwQYUwk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\International\Geo\Nation buwQYUwk.exe -
Executes dropped EXE 2 IoCs
Processes:
buwQYUwk.exeEgwkIoIc.exepid process 2180 buwQYUwk.exe 2736 EgwkIoIc.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exebuwQYUwk.exepid process 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
buwQYUwk.exeEgwkIoIc.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\buwQYUwk.exe = "C:\\Users\\Admin\\Cqwowoss\\buwQYUwk.exe" buwQYUwk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EgwkIoIc.exe = "C:\\ProgramData\\JYYwwokc\\EgwkIoIc.exe" EgwkIoIc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\aGUMkUAk.exe = "C:\\Users\\Admin\\AOoYUUMs\\aGUMkUAk.exe" 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AccEEUkI.exe = "C:\\ProgramData\\QcsoIoUo\\AccEEUkI.exe" 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\buwQYUwk.exe = "C:\\Users\\Admin\\Cqwowoss\\buwQYUwk.exe" 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EgwkIoIc.exe = "C:\\ProgramData\\JYYwwokc\\EgwkIoIc.exe" 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2744 2000 WerFault.exe AccEEUkI.exe 2200 2204 WerFault.exe aGUMkUAk.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2728 reg.exe 1112 reg.exe 1100 reg.exe 2632 reg.exe 1448 reg.exe 280 reg.exe 2016 reg.exe 2732 reg.exe 2032 reg.exe 2252 reg.exe 872 reg.exe 2596 reg.exe 1040 reg.exe 1808 reg.exe 772 reg.exe 1740 reg.exe 2456 reg.exe 2004 reg.exe 2020 reg.exe 2672 reg.exe 1936 reg.exe 2584 reg.exe 2372 reg.exe 1400 reg.exe 2568 reg.exe 792 reg.exe 496 reg.exe 1388 reg.exe 2712 reg.exe 2796 reg.exe 1888 reg.exe 2828 reg.exe 2812 reg.exe 1936 reg.exe 1936 reg.exe 3000 reg.exe 1564 reg.exe 1320 reg.exe 2248 reg.exe 1284 reg.exe 1672 reg.exe 1484 reg.exe 1496 reg.exe 2940 reg.exe 2024 reg.exe 2280 reg.exe 1984 reg.exe 1672 reg.exe 2928 reg.exe 2160 reg.exe 2716 reg.exe 580 reg.exe 1980 reg.exe 2804 reg.exe 844 reg.exe 1324 reg.exe 2952 reg.exe 588 reg.exe 1292 reg.exe 2692 reg.exe 1032 reg.exe 900 reg.exe 1732 reg.exe 2412 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exepid process 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2776 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2776 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2520 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2520 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 392 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 392 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 908 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 908 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1032 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1032 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2456 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2456 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2652 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2652 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2296 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2296 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 772 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 772 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2300 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2300 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 632 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 632 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1832 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1832 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2172 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2172 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2644 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2644 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 324 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 324 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2716 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2716 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2028 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2028 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2396 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2396 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2096 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2096 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1628 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1628 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2472 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2472 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1820 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1820 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2756 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2756 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1316 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1316 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 844 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 844 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1004 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1004 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 2592 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1824 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe 1824 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
buwQYUwk.exepid process 2180 buwQYUwk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
buwQYUwk.exepid process 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe 2180 buwQYUwk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.execmd.execmd.exe2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.execmd.execmd.exedescription pid process target process PID 2740 wrote to memory of 2180 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe buwQYUwk.exe PID 2740 wrote to memory of 2180 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe buwQYUwk.exe PID 2740 wrote to memory of 2180 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe buwQYUwk.exe PID 2740 wrote to memory of 2180 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe buwQYUwk.exe PID 2740 wrote to memory of 2736 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe EgwkIoIc.exe PID 2740 wrote to memory of 2736 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe EgwkIoIc.exe PID 2740 wrote to memory of 2736 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe EgwkIoIc.exe PID 2740 wrote to memory of 2736 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe EgwkIoIc.exe PID 2740 wrote to memory of 2692 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2692 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2692 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2692 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2692 wrote to memory of 2576 2692 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2692 wrote to memory of 2576 2692 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2692 wrote to memory of 2576 2692 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2692 wrote to memory of 2576 2692 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2740 wrote to memory of 1248 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 1248 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 1248 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 1248 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2952 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2952 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2952 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2952 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2612 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2612 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2612 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2612 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2740 wrote to memory of 2724 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2724 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2724 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2740 wrote to memory of 2724 2740 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2724 wrote to memory of 2524 2724 cmd.exe cscript.exe PID 2724 wrote to memory of 2524 2724 cmd.exe cscript.exe PID 2724 wrote to memory of 2524 2724 cmd.exe cscript.exe PID 2724 wrote to memory of 2524 2724 cmd.exe cscript.exe PID 2576 wrote to memory of 2644 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 2644 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 2644 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 2644 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2644 wrote to memory of 2776 2644 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2644 wrote to memory of 2776 2644 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2644 wrote to memory of 2776 2644 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2644 wrote to memory of 2776 2644 cmd.exe 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe PID 2576 wrote to memory of 3044 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 3044 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 3044 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 3044 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 1812 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 1812 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 1812 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 1812 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 2768 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 2768 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 2768 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 2768 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe reg.exe PID 2576 wrote to memory of 1308 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 1308 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 1308 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 2576 wrote to memory of 1308 2576 2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe cmd.exe PID 1308 wrote to memory of 2028 1308 cmd.exe cscript.exe PID 1308 wrote to memory of 2028 1308 cmd.exe cscript.exe PID 1308 wrote to memory of 2028 1308 cmd.exe cscript.exe PID 1308 wrote to memory of 2028 1308 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Cqwowoss\buwQYUwk.exe"C:\Users\Admin\Cqwowoss\buwQYUwk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\JYYwwokc\EgwkIoIc.exe"C:\ProgramData\JYYwwokc\EgwkIoIc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock37⤵
- Adds Run key to start application
-
C:\Users\Admin\AOoYUUMs\aGUMkUAk.exe"C:\Users\Admin\AOoYUUMs\aGUMkUAk.exe"38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 3639⤵
- Program crash
-
C:\ProgramData\QcsoIoUo\AccEEUkI.exe"C:\ProgramData\QcsoIoUo\AccEEUkI.exe"38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 3639⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock65⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_7a8c3761bddf48493b1c70a2c7c0edf8_virlock241⤵