Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 12:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe
-
Size
203KB
-
MD5
4634f3182a76687cfbfc14aa296e9c9f
-
SHA1
62844fe8dc8d44ad2d8dfb230bb57d1399dd5d87
-
SHA256
75ff97b9ef51bd53c781f4992d6f2393f7571cf994b7ad23f90895071e3afd4b
-
SHA512
c9d602b2d25843c537a414371847315f7ac8d8641f3d77cba1693aeafc895deab200a0693f9ef35b5a3a46d6efd9f3c4c5e7f1e0d1ba7e7f9679dd751999811f
-
SSDEEP
3072:4fAyzj6yyRhFgl9xEzOPeL4TmuzwvwVKMV8/9fggeE+YgtyIGp/NGu:iAyzCRhFQxYO2LmwKDY3EEL
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
xQkggQog.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation xQkggQog.exe -
Executes dropped EXE 2 IoCs
Processes:
xQkggQog.exetgcsAwwM.exepid process 2812 xQkggQog.exe 2540 tgcsAwwM.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exexQkggQog.exepid process 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exexQkggQog.exetgcsAwwM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\xQkggQog.exe = "C:\\Users\\Admin\\KIIAsMoI\\xQkggQog.exe" 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tgcsAwwM.exe = "C:\\ProgramData\\nakEwEYQ\\tgcsAwwM.exe" 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\xQkggQog.exe = "C:\\Users\\Admin\\KIIAsMoI\\xQkggQog.exe" xQkggQog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tgcsAwwM.exe = "C:\\ProgramData\\nakEwEYQ\\tgcsAwwM.exe" tgcsAwwM.exe -
Drops file in Windows directory 1 IoCs
Processes:
xQkggQog.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico xQkggQog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1836 reg.exe 1904 reg.exe 2464 reg.exe 1352 reg.exe 1668 reg.exe 348 reg.exe 2384 reg.exe 1448 reg.exe 2956 reg.exe 1120 reg.exe 2096 reg.exe 1916 reg.exe 3020 reg.exe 1472 reg.exe 1404 reg.exe 2820 reg.exe 1900 reg.exe 2464 reg.exe 1596 reg.exe 2820 reg.exe 356 reg.exe 1556 reg.exe 1976 reg.exe 1728 reg.exe 2944 reg.exe 668 reg.exe 2852 reg.exe 1884 reg.exe 344 reg.exe 2852 reg.exe 1792 reg.exe 668 reg.exe 1608 reg.exe 1440 reg.exe 1728 reg.exe 1592 reg.exe 3036 reg.exe 1660 reg.exe 1768 reg.exe 2264 reg.exe 2380 reg.exe 1964 reg.exe 2276 reg.exe 1916 reg.exe 2848 reg.exe 412 reg.exe 1176 reg.exe 588 reg.exe 1660 reg.exe 668 reg.exe 1616 reg.exe 1980 reg.exe 788 reg.exe 1444 reg.exe 2084 reg.exe 948 reg.exe 2804 reg.exe 1668 reg.exe 576 reg.exe 2412 reg.exe 2204 reg.exe 2988 reg.exe 2272 reg.exe 1312 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exepid process 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2784 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2784 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1544 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1544 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 788 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 788 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1300 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1300 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 328 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 328 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2528 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2528 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2728 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2728 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2196 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2196 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2924 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2924 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1460 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1460 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1520 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1520 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 328 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 328 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2472 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2472 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2200 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2200 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1612 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1612 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1504 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1504 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2644 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2644 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2692 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2692 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2932 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2932 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2268 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2268 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2884 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2884 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1228 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1228 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 992 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 992 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 352 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 352 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1512 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1512 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2932 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2932 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1100 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1100 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 884 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 884 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1632 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 1632 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2764 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe 2764 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
xQkggQog.exepid process 2812 xQkggQog.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
xQkggQog.exepid process 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe 2812 xQkggQog.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.execmd.execmd.exe2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.execmd.execmd.exedescription pid process target process PID 2964 wrote to memory of 2812 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe xQkggQog.exe PID 2964 wrote to memory of 2812 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe xQkggQog.exe PID 2964 wrote to memory of 2812 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe xQkggQog.exe PID 2964 wrote to memory of 2812 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe xQkggQog.exe PID 2964 wrote to memory of 2540 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe tgcsAwwM.exe PID 2964 wrote to memory of 2540 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe tgcsAwwM.exe PID 2964 wrote to memory of 2540 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe tgcsAwwM.exe PID 2964 wrote to memory of 2540 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe tgcsAwwM.exe PID 2964 wrote to memory of 2828 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2828 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2828 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2828 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2828 wrote to memory of 1280 2828 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2828 wrote to memory of 1280 2828 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2828 wrote to memory of 1280 2828 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2828 wrote to memory of 1280 2828 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2964 wrote to memory of 2732 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2732 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2732 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2732 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2572 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2572 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2572 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2572 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 1312 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 1312 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 1312 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 1312 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 2964 wrote to memory of 2468 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2468 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2468 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2964 wrote to memory of 2468 2964 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2468 wrote to memory of 2464 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2464 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2464 2468 cmd.exe cscript.exe PID 2468 wrote to memory of 2464 2468 cmd.exe cscript.exe PID 1280 wrote to memory of 2608 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 2608 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 2608 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 2608 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 2608 wrote to memory of 2784 2608 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2608 wrote to memory of 2784 2608 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2608 wrote to memory of 2784 2608 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 2608 wrote to memory of 2784 2608 cmd.exe 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe PID 1280 wrote to memory of 2928 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 2928 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 2928 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 2928 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 332 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 332 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 332 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 332 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 112 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 112 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 112 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 112 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe reg.exe PID 1280 wrote to memory of 1940 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 1940 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 1940 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1280 wrote to memory of 1940 1280 2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe cmd.exe PID 1940 wrote to memory of 2140 1940 cmd.exe cscript.exe PID 1940 wrote to memory of 2140 1940 cmd.exe cscript.exe PID 1940 wrote to memory of 2140 1940 cmd.exe cscript.exe PID 1940 wrote to memory of 2140 1940 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\KIIAsMoI\xQkggQog.exe"C:\Users\Admin\KIIAsMoI\xQkggQog.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\nakEwEYQ\tgcsAwwM.exe"C:\ProgramData\nakEwEYQ\tgcsAwwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_4634f3182a76687cfbfc14aa296e9c9f_virlock241⤵