Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe
-
Size
193KB
-
MD5
3414b9dab576b04b3d434d024814b37b
-
SHA1
58af35de5df404d5fb254fc6bb12b593ce1a53c8
-
SHA256
fe624bc3ace0ff8a497e2b811b49d7e4cde3c5ca267b71843725d741d9747824
-
SHA512
4f62139ad922da2e23cd313b0d7bdc25b201d72b1d036a2c1f95c9cb0c5767d5c18f5ad48b2668fe7470fd40c63f26ca6bf3fa268581206f7ae3b1ac5a131a57
-
SSDEEP
3072:0sNHrBhbzwGj9vTj9+M9G3S7V4hL8H6X8OUs0DHAa1ApZbNa+Z:0sNLnbzwG9j/9zV4lGOgga1ApZ5B
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
zessosAI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation zessosAI.exe -
Executes dropped EXE 2 IoCs
Processes:
zessosAI.exezGMsMIEo.exepid process 464 zessosAI.exe 2936 zGMsMIEo.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exezessosAI.exepid process 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exezessosAI.exezGMsMIEo.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zessosAI.exe = "C:\\Users\\Admin\\zWQMYIsk\\zessosAI.exe" 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zGMsMIEo.exe = "C:\\ProgramData\\iqkEoQIc\\zGMsMIEo.exe" 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zessosAI.exe = "C:\\Users\\Admin\\zWQMYIsk\\zessosAI.exe" zessosAI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zGMsMIEo.exe = "C:\\ProgramData\\iqkEoQIc\\zGMsMIEo.exe" zGMsMIEo.exe -
Drops file in Windows directory 1 IoCs
Processes:
zessosAI.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico zessosAI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2772 reg.exe 1444 reg.exe 988 reg.exe 696 reg.exe 2624 reg.exe 1116 reg.exe 1504 reg.exe 2952 reg.exe 2000 reg.exe 2312 reg.exe 2808 reg.exe 3056 reg.exe 1300 reg.exe 1856 reg.exe 2592 reg.exe 1956 reg.exe 2136 reg.exe 772 reg.exe 2616 reg.exe 844 reg.exe 2444 reg.exe 2748 reg.exe 2932 reg.exe 2516 reg.exe 896 reg.exe 2636 reg.exe 632 reg.exe 632 reg.exe 1808 reg.exe 2064 reg.exe 1480 reg.exe 1708 reg.exe 2288 reg.exe 2044 reg.exe 2612 reg.exe 2488 reg.exe 3000 reg.exe 1968 reg.exe 1856 reg.exe 2512 reg.exe 2880 reg.exe 2904 reg.exe 1628 reg.exe 1856 reg.exe 1992 reg.exe 3060 reg.exe 544 reg.exe 2616 reg.exe 1088 reg.exe 2720 reg.exe 2628 reg.exe 1444 reg.exe 2560 reg.exe 2368 reg.exe 2284 reg.exe 2588 reg.exe 376 reg.exe 656 reg.exe 2372 reg.exe 2384 reg.exe 2404 reg.exe 984 reg.exe 1300 reg.exe 2180 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exepid process 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1668 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1668 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1948 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1948 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 532 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 532 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2116 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2116 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 788 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 788 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2664 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2664 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1952 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1952 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2260 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2260 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2376 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2376 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1136 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1136 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1592 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1592 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2800 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2800 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1300 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1300 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1880 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1880 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2312 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2312 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1404 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1404 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 668 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 668 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2560 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2560 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 296 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 296 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1112 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1112 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1880 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1880 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2040 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2040 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2760 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2760 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2512 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2512 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2772 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2772 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2408 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2408 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1660 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 1660 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3000 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 3000 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2540 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe 2540 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
zessosAI.exepid process 464 zessosAI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
zessosAI.exepid process 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe 464 zessosAI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.execmd.execmd.exe2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.execmd.execmd.exedescription pid process target process PID 2056 wrote to memory of 464 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zessosAI.exe PID 2056 wrote to memory of 464 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zessosAI.exe PID 2056 wrote to memory of 464 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zessosAI.exe PID 2056 wrote to memory of 464 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zessosAI.exe PID 2056 wrote to memory of 2936 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zGMsMIEo.exe PID 2056 wrote to memory of 2936 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zGMsMIEo.exe PID 2056 wrote to memory of 2936 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zGMsMIEo.exe PID 2056 wrote to memory of 2936 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe zGMsMIEo.exe PID 2056 wrote to memory of 2720 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2720 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2720 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2720 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2720 wrote to memory of 2616 2720 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2720 wrote to memory of 2616 2720 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2720 wrote to memory of 2616 2720 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2720 wrote to memory of 2616 2720 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2056 wrote to memory of 2368 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2368 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2368 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2368 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2968 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2968 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2968 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2968 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2316 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2316 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2316 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2316 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2056 wrote to memory of 2660 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2660 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2660 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2056 wrote to memory of 2660 2056 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2660 wrote to memory of 2612 2660 cmd.exe cscript.exe PID 2660 wrote to memory of 2612 2660 cmd.exe cscript.exe PID 2660 wrote to memory of 2612 2660 cmd.exe cscript.exe PID 2660 wrote to memory of 2612 2660 cmd.exe cscript.exe PID 2616 wrote to memory of 1856 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 1856 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 1856 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 1856 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 1856 wrote to memory of 1668 1856 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1856 wrote to memory of 1668 1856 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1856 wrote to memory of 1668 1856 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 1856 wrote to memory of 1668 1856 cmd.exe 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe PID 2616 wrote to memory of 1840 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 1840 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 1840 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 1840 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 304 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 304 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 304 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 304 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 2768 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 2768 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 2768 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 2768 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe reg.exe PID 2616 wrote to memory of 2016 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 2016 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 2016 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2616 wrote to memory of 2016 2616 2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe cmd.exe PID 2016 wrote to memory of 1736 2016 cmd.exe cscript.exe PID 2016 wrote to memory of 1736 2016 cmd.exe cscript.exe PID 2016 wrote to memory of 1736 2016 cmd.exe cscript.exe PID 2016 wrote to memory of 1736 2016 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\zWQMYIsk\zessosAI.exe"C:\Users\Admin\zWQMYIsk\zessosAI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\iqkEoQIc\zGMsMIEo.exe"C:\ProgramData\iqkEoQIc\zGMsMIEo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_3414b9dab576b04b3d434d024814b37b_virlock241⤵