Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe
-
Size
205KB
-
MD5
5ef48f63127987a1df52d23c840bea4a
-
SHA1
2d5073bf30bff3737ad6693fae369a52830e34d1
-
SHA256
9514d108766f1afd9f48bad55acde065e566d02b0ce97ed5366aa1678e328fdb
-
SHA512
a6684415e6b2322acddef1bb0f03c6829a29baff04fedf65ca83cd87521292d666e3969441fe57718fd2350ac1788ac611be67f9e7615bd2d9dbbb8040514985
-
SSDEEP
3072:8X9VAOolOJdYht/RoY64iQDy7cvL3TV06zi/q8ej1wN/jMo+As0164PttTs/wT:8X9CCIt/yl43y7i3TmeO4oI0EOWw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (66) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HakUIUEI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation HakUIUEI.exe -
Executes dropped EXE 2 IoCs
Processes:
HakUIUEI.exeqGIQYMQY.exepid process 2960 HakUIUEI.exe 2016 qGIQYMQY.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeHakUIUEI.exepid process 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeHakUIUEI.exeqGIQYMQY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SsMsMEEs.exe = "C:\\Users\\Admin\\JCscUAcI\\SsMsMEEs.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rUwEksMo.exe = "C:\\ProgramData\\yOgwUQwY\\rUwEksMo.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HakUIUEI.exe = "C:\\Users\\Admin\\nQkowAco\\HakUIUEI.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qGIQYMQY.exe = "C:\\ProgramData\\gOQgwYgw\\qGIQYMQY.exe" 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HakUIUEI.exe = "C:\\Users\\Admin\\nQkowAco\\HakUIUEI.exe" HakUIUEI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qGIQYMQY.exe = "C:\\ProgramData\\gOQgwYgw\\qGIQYMQY.exe" qGIQYMQY.exe -
Drops file in Windows directory 1 IoCs
Processes:
HakUIUEI.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico HakUIUEI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1988 2156 WerFault.exe SsMsMEEs.exe 1628 1668 WerFault.exe rUwEksMo.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2220 reg.exe 1660 reg.exe 3068 reg.exe 2856 reg.exe 1360 reg.exe 2840 reg.exe 684 reg.exe 988 reg.exe 908 reg.exe 2308 reg.exe 2200 reg.exe 2192 reg.exe 1624 reg.exe 2516 reg.exe 2868 reg.exe 2988 reg.exe 3032 reg.exe 888 reg.exe 2324 reg.exe 1612 reg.exe 2712 reg.exe 2216 reg.exe 928 reg.exe 2956 reg.exe 2852 reg.exe 2768 reg.exe 2236 reg.exe 1120 reg.exe 2196 reg.exe 2576 reg.exe 2816 reg.exe 836 reg.exe 2084 reg.exe 1908 reg.exe 2560 reg.exe 2132 reg.exe 1760 reg.exe 1632 reg.exe 2656 reg.exe 1648 reg.exe 2760 reg.exe 2340 reg.exe 892 reg.exe 1864 reg.exe 2040 reg.exe 576 reg.exe 1492 reg.exe 2856 reg.exe 852 reg.exe 2972 reg.exe 1436 reg.exe 2496 reg.exe 1740 reg.exe 2804 reg.exe 476 reg.exe 2116 reg.exe 1732 reg.exe 1324 reg.exe 1940 reg.exe 2388 reg.exe 2980 reg.exe 2684 reg.exe 1384 reg.exe 2360 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exepid process 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2884 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2884 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2852 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2852 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 760 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 760 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1536 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1536 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2012 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2012 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2076 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2076 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2532 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2532 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1304 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2936 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2936 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2900 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2900 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2940 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2940 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2756 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2756 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2076 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2076 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2404 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2404 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2092 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2092 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1820 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1820 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 340 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 340 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2780 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2780 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2136 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2532 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2532 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2204 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2204 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 320 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 320 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 572 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 572 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2972 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2972 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2412 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2412 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1284 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1284 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2116 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2116 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1864 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 1864 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2484 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe 2484 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
HakUIUEI.exepid process 2960 HakUIUEI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
HakUIUEI.exepid process 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe 2960 HakUIUEI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.execmd.execmd.exe2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.execmd.execmd.exedescription pid process target process PID 2188 wrote to memory of 2960 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HakUIUEI.exe PID 2188 wrote to memory of 2960 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HakUIUEI.exe PID 2188 wrote to memory of 2960 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HakUIUEI.exe PID 2188 wrote to memory of 2960 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe HakUIUEI.exe PID 2188 wrote to memory of 2016 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe qGIQYMQY.exe PID 2188 wrote to memory of 2016 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe qGIQYMQY.exe PID 2188 wrote to memory of 2016 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe qGIQYMQY.exe PID 2188 wrote to memory of 2016 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe qGIQYMQY.exe PID 2188 wrote to memory of 2768 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2768 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2768 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2768 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2768 wrote to memory of 2676 2768 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2768 wrote to memory of 2676 2768 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2768 wrote to memory of 2676 2768 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2768 wrote to memory of 2676 2768 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2188 wrote to memory of 2920 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2920 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2920 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2920 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2652 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2652 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2652 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2652 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2040 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2040 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2040 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2040 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2188 wrote to memory of 2860 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2860 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2860 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2188 wrote to memory of 2860 2188 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2860 wrote to memory of 2772 2860 cmd.exe cscript.exe PID 2860 wrote to memory of 2772 2860 cmd.exe cscript.exe PID 2860 wrote to memory of 2772 2860 cmd.exe cscript.exe PID 2860 wrote to memory of 2772 2860 cmd.exe cscript.exe PID 2676 wrote to memory of 2604 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 2604 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 2604 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 2604 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2604 wrote to memory of 2884 2604 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2604 wrote to memory of 2884 2604 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2604 wrote to memory of 2884 2604 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2604 wrote to memory of 2884 2604 cmd.exe 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe PID 2676 wrote to memory of 2984 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2984 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2984 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2984 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2992 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2992 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2992 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 2992 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 3032 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 3032 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 3032 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 3032 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe reg.exe PID 2676 wrote to memory of 1540 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 1540 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 1540 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 2676 wrote to memory of 1540 2676 2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe cmd.exe PID 1540 wrote to memory of 652 1540 cmd.exe cscript.exe PID 1540 wrote to memory of 652 1540 cmd.exe cscript.exe PID 1540 wrote to memory of 652 1540 cmd.exe cscript.exe PID 1540 wrote to memory of 652 1540 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\nQkowAco\HakUIUEI.exe"C:\Users\Admin\nQkowAco\HakUIUEI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\gOQgwYgw\qGIQYMQY.exe"C:\ProgramData\gOQgwYgw\qGIQYMQY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock131⤵
- Adds Run key to start application
-
C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"C:\Users\Admin\JCscUAcI\SsMsMEEs.exe"132⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36133⤵
- Program crash
-
C:\ProgramData\yOgwUQwY\rUwEksMo.exe"C:\ProgramData\yOgwUQwY\rUwEksMo.exe"132⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 36133⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_5ef48f63127987a1df52d23c840bea4a_virlock241⤵