Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 12:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe
-
Size
192KB
-
MD5
f3439ffb42bfeb533a98d44a8fcc688c
-
SHA1
ff36d15fe6395bd6fde81cd8ea8b3380c358dce1
-
SHA256
c6ac5c08c526e3933514ecce5e067fa8516048d620c91d8618c2ed54872f5aa3
-
SHA512
5322b41d1f0c6d10d0726bf7c6ea2481c6b240ebe51352ba06a1674b59b110b178b833dbbc3161787c26394e3326a09cbc9a3e6736395753e62a14bd192225f9
-
SSDEEP
3072:dPyTVtqWMCmGMZyUoWjPOsqZzOvFnHMw0CLM9SXTcThSKjhHNRYsEdw3HRF+YyWv:dPaOjmsrMrEM98TctSKysEoHzrEp
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tuQoQssk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation tuQoQssk.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 744 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
tuQoQssk.exevgMwkwAU.exepid process 2068 tuQoQssk.exe 2840 vgMwkwAU.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exetuQoQssk.exepid process 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exetuQoQssk.exevgMwkwAU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\tuQoQssk.exe = "C:\\Users\\Admin\\LIAcccQM\\tuQoQssk.exe" 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vgMwkwAU.exe = "C:\\ProgramData\\raEMQQsI\\vgMwkwAU.exe" 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\tuQoQssk.exe = "C:\\Users\\Admin\\LIAcccQM\\tuQoQssk.exe" tuQoQssk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vgMwkwAU.exe = "C:\\ProgramData\\raEMQQsI\\vgMwkwAU.exe" vgMwkwAU.exe -
Drops file in Windows directory 1 IoCs
Processes:
tuQoQssk.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico tuQoQssk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1540 reg.exe 3024 reg.exe 1420 reg.exe 1744 reg.exe 2284 reg.exe 2556 reg.exe 2200 reg.exe 2520 reg.exe 1056 reg.exe 1848 reg.exe 1420 reg.exe 3060 reg.exe 2716 reg.exe 2248 reg.exe 2428 reg.exe 1616 reg.exe 2232 reg.exe 1316 reg.exe 876 reg.exe 1648 reg.exe 2268 reg.exe 1236 reg.exe 2672 reg.exe 2724 reg.exe 2224 reg.exe 1648 reg.exe 2860 reg.exe 1152 reg.exe 1560 reg.exe 1280 reg.exe 1648 reg.exe 2052 reg.exe 832 reg.exe 1976 reg.exe 1332 reg.exe 2304 reg.exe 1708 reg.exe 2528 reg.exe 2056 reg.exe 2896 reg.exe 1912 reg.exe 2584 reg.exe 2064 reg.exe 2304 reg.exe 2012 reg.exe 2092 reg.exe 2464 reg.exe 2964 reg.exe 1616 reg.exe 348 reg.exe 1576 reg.exe 336 reg.exe 2820 reg.exe 2816 reg.exe 1360 reg.exe 1972 reg.exe 1512 reg.exe 1772 reg.exe 2988 reg.exe 1976 reg.exe 1924 reg.exe 1372 reg.exe 1956 reg.exe 2932 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exepid process 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2896 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2896 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2612 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2612 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2116 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2116 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2144 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2144 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2228 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2228 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2936 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2936 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2584 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2584 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1548 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1548 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 588 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 588 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1676 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1676 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1508 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1508 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2152 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2152 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 236 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 236 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1776 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1776 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 824 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 824 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1540 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1540 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1276 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1276 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1928 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1928 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1628 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1628 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 608 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 608 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 696 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 696 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 700 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 700 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1288 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 1288 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2780 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2780 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2792 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2792 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2124 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2124 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 328 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 328 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 536 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 536 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2960 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 2960 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 804 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe 804 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tuQoQssk.exepid process 2068 tuQoQssk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
tuQoQssk.exepid process 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe 2068 tuQoQssk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.execmd.execmd.exe2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.execmd.execmd.exedescription pid process target process PID 2980 wrote to memory of 2068 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe tuQoQssk.exe PID 2980 wrote to memory of 2068 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe tuQoQssk.exe PID 2980 wrote to memory of 2068 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe tuQoQssk.exe PID 2980 wrote to memory of 2068 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe tuQoQssk.exe PID 2980 wrote to memory of 2840 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe vgMwkwAU.exe PID 2980 wrote to memory of 2840 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe vgMwkwAU.exe PID 2980 wrote to memory of 2840 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe vgMwkwAU.exe PID 2980 wrote to memory of 2840 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe vgMwkwAU.exe PID 2980 wrote to memory of 2776 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2776 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2776 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2776 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2820 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2820 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2820 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2820 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2672 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2672 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2672 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2672 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2640 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2640 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2640 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2640 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2980 wrote to memory of 2932 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2932 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2932 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2980 wrote to memory of 2932 2980 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2776 wrote to memory of 2720 2776 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2776 wrote to memory of 2720 2776 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2776 wrote to memory of 2720 2776 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2776 wrote to memory of 2720 2776 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2932 wrote to memory of 2580 2932 cmd.exe cscript.exe PID 2932 wrote to memory of 2580 2932 cmd.exe cscript.exe PID 2932 wrote to memory of 2580 2932 cmd.exe cscript.exe PID 2932 wrote to memory of 2580 2932 cmd.exe cscript.exe PID 2720 wrote to memory of 2860 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2860 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2860 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2860 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2860 wrote to memory of 2896 2860 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2860 wrote to memory of 2896 2860 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2860 wrote to memory of 2896 2860 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2860 wrote to memory of 2896 2860 cmd.exe 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe PID 2720 wrote to memory of 3004 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3004 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3004 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3004 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 2988 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 2988 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 2988 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 2988 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3036 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3036 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3036 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 3036 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe reg.exe PID 2720 wrote to memory of 2288 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2288 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2288 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2720 wrote to memory of 2288 2720 2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe cmd.exe PID 2288 wrote to memory of 1580 2288 cmd.exe cscript.exe PID 2288 wrote to memory of 1580 2288 cmd.exe cscript.exe PID 2288 wrote to memory of 1580 2288 cmd.exe cscript.exe PID 2288 wrote to memory of 1580 2288 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\LIAcccQM\tuQoQssk.exe"C:\Users\Admin\LIAcccQM\tuQoQssk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\raEMQQsI\vgMwkwAU.exe"C:\ProgramData\raEMQQsI\vgMwkwAU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_f3439ffb42bfeb533a98d44a8fcc688c_virlock241⤵