Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe
-
Size
186KB
-
MD5
68671bda5a8af1e69521590614c39b61
-
SHA1
ee94523f75c634471eeb8481a5c0db64d27b18fa
-
SHA256
f3be1b2fa58fca1e478d18c992d3261566350f392bdd813eaa63f8265304e4c7
-
SHA512
47f7c6ebee835c06aa324a66bf740fb77b4d7a040d4cbc9a8ec916e1f9b01cdfc5f463943546bbb6f46285d73bfadee901912ca1302d02a0a0d7d55ea50abf5e
-
SSDEEP
3072:gRQcGe0ul4OJ2mzmlTGtas1Q1XPNQGKNl0XWq4/eU5XbM3cOpzs6l2+wRm4fkuZt:gRYe0Wx2Emlatas1Q1XPNQGKNl0XWq49
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dasQkEsg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation dasQkEsg.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3056 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
dasQkEsg.exegGEgocgQ.exepid process 1672 dasQkEsg.exe 3064 gGEgocgQ.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exedasQkEsg.exepid process 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exedasQkEsg.exegGEgocgQ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\dasQkEsg.exe = "C:\\Users\\Admin\\qcAQUokk\\dasQkEsg.exe" 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gGEgocgQ.exe = "C:\\ProgramData\\leUEYcsA\\gGEgocgQ.exe" 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\dasQkEsg.exe = "C:\\Users\\Admin\\qcAQUokk\\dasQkEsg.exe" dasQkEsg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gGEgocgQ.exe = "C:\\ProgramData\\leUEYcsA\\gGEgocgQ.exe" gGEgocgQ.exe -
Drops file in Windows directory 1 IoCs
Processes:
dasQkEsg.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico dasQkEsg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1756 reg.exe 2584 reg.exe 1960 reg.exe 1156 reg.exe 1460 reg.exe 2852 reg.exe 2804 reg.exe 3068 reg.exe 2348 reg.exe 1636 reg.exe 284 reg.exe 2792 reg.exe 1640 reg.exe 1500 reg.exe 2520 reg.exe 2656 reg.exe 2008 reg.exe 352 reg.exe 1904 reg.exe 2664 reg.exe 608 reg.exe 2872 reg.exe 2460 reg.exe 1156 reg.exe 2412 reg.exe 1124 reg.exe 2012 reg.exe 776 reg.exe 1596 reg.exe 2760 reg.exe 976 reg.exe 2564 reg.exe 928 reg.exe 2724 reg.exe 1920 reg.exe 836 reg.exe 2460 reg.exe 2956 reg.exe 2472 reg.exe 2792 reg.exe 2312 reg.exe 1264 reg.exe 1796 reg.exe 2840 reg.exe 1472 reg.exe 1880 reg.exe 2432 reg.exe 2512 reg.exe 2296 reg.exe 1628 reg.exe 2300 reg.exe 2328 reg.exe 888 reg.exe 1624 reg.exe 2336 reg.exe 3032 reg.exe 1568 reg.exe 1696 reg.exe 2996 reg.exe 328 reg.exe 1852 reg.exe 1472 reg.exe 628 reg.exe 412 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exepid process 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2800 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2800 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1600 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1600 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 796 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 796 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1720 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1720 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1960 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1960 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2772 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2772 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2812 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2812 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2800 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2800 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2520 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2520 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 612 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 612 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2732 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2732 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 112 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 112 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2772 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2772 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 108 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 108 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2808 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2808 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1436 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1436 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2736 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2736 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2740 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2740 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 112 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 112 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1524 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1524 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 108 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 108 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2656 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2656 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2600 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2600 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2736 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 2736 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1508 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1508 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1584 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1584 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1416 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1416 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1232 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1232 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1860 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1860 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1628 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe 1628 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dasQkEsg.exepid process 1672 dasQkEsg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
dasQkEsg.exepid process 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe 1672 dasQkEsg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.execmd.execmd.exe2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.execmd.execmd.exedescription pid process target process PID 2080 wrote to memory of 1672 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe dasQkEsg.exe PID 2080 wrote to memory of 1672 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe dasQkEsg.exe PID 2080 wrote to memory of 1672 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe dasQkEsg.exe PID 2080 wrote to memory of 1672 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe dasQkEsg.exe PID 2080 wrote to memory of 3064 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe gGEgocgQ.exe PID 2080 wrote to memory of 3064 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe gGEgocgQ.exe PID 2080 wrote to memory of 3064 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe gGEgocgQ.exe PID 2080 wrote to memory of 3064 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe gGEgocgQ.exe PID 2080 wrote to memory of 2760 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2760 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2760 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2760 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2888 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2888 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2888 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2888 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2884 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2884 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2884 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2884 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2612 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2612 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2612 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2612 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2080 wrote to memory of 2632 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2632 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2632 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2080 wrote to memory of 2632 2080 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2760 wrote to memory of 2724 2760 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2760 wrote to memory of 2724 2760 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2760 wrote to memory of 2724 2760 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2760 wrote to memory of 2724 2760 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2632 wrote to memory of 2528 2632 cmd.exe cscript.exe PID 2632 wrote to memory of 2528 2632 cmd.exe cscript.exe PID 2632 wrote to memory of 2528 2632 cmd.exe cscript.exe PID 2632 wrote to memory of 2528 2632 cmd.exe cscript.exe PID 2724 wrote to memory of 2708 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 2708 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 2708 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 2708 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2708 wrote to memory of 2800 2708 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2708 wrote to memory of 2800 2708 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2708 wrote to memory of 2800 2708 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2708 wrote to memory of 2800 2708 cmd.exe 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe PID 2724 wrote to memory of 2816 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2816 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2816 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2816 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2628 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2628 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2628 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2628 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2664 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2664 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2664 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 2664 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe reg.exe PID 2724 wrote to memory of 1564 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 1564 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 1564 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 2724 wrote to memory of 1564 2724 2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe cmd.exe PID 1564 wrote to memory of 2328 1564 cmd.exe cscript.exe PID 1564 wrote to memory of 2328 1564 cmd.exe cscript.exe PID 1564 wrote to memory of 2328 1564 cmd.exe cscript.exe PID 1564 wrote to memory of 2328 1564 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\qcAQUokk\dasQkEsg.exe"C:\Users\Admin\qcAQUokk\dasQkEsg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\leUEYcsA\gGEgocgQ.exe"C:\ProgramData\leUEYcsA\gGEgocgQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_68671bda5a8af1e69521590614c39b61_virlock241⤵