Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
-
Size
117KB
-
MD5
e9d4796319f758c383ec212ba8dac130
-
SHA1
085a2681e9ab5a1b4db78b8987de0d3326a54f08
-
SHA256
c15f130a35c8d363abc25427cf994c4eda8b3a171e528cddb7b5046b29aaeef1
-
SHA512
6a6c880b330b370bbe2eac482c8474c169b125c8686ce480565e95dd08fb87a20932aa2d03f256439460aa2a10904709a4c44d05eb1a5cb438193c7d5ef60207
-
SSDEEP
3072:a9UuK+WQq3bxHGJEePFkBxWbpZAdIpDNr5Xi/eRZ34t3Y:a9mNZWP4mr82RZItI
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\International\Geo\Nation NmEckgIM.exe -
Deletes itself 1 IoCs
pid Process 2688 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1964 NmEckgIM.exe 2504 guwMkQcM.exe -
Loads dropped DLL 20 IoCs
pid Process 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\NmEckgIM.exe = "C:\\Users\\Admin\\qwwckscw\\NmEckgIM.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\guwMkQcM.exe = "C:\\ProgramData\\NCcAAEks\\guwMkQcM.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\NmEckgIM.exe = "C:\\Users\\Admin\\qwwckscw\\NmEckgIM.exe" NmEckgIM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\guwMkQcM.exe = "C:\\ProgramData\\NCcAAEks\\guwMkQcM.exe" guwMkQcM.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\LUMwYYcI.exe = "C:\\Users\\Admin\\WoYsMcQM\\LUMwYYcI.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scAsoEsw.exe = "C:\\ProgramData\\kGEksokQ\\scAsoEsw.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1688 1796 WerFault.exe 451 2932 2804 WerFault.exe 145 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2836 reg.exe 2280 reg.exe 2696 reg.exe 1700 reg.exe 2952 reg.exe 1540 reg.exe 2208 reg.exe 2456 reg.exe 524 reg.exe 2888 reg.exe 1764 reg.exe 2240 reg.exe 2004 reg.exe 1956 reg.exe 2788 reg.exe 2716 reg.exe 1360 reg.exe 1172 reg.exe 2868 reg.exe 2040 reg.exe 1260 reg.exe 1360 reg.exe 2000 reg.exe 2544 reg.exe 2688 reg.exe 2896 reg.exe 868 reg.exe 2360 reg.exe 1280 reg.exe 1664 reg.exe 2788 reg.exe 2512 reg.exe 652 reg.exe 1172 reg.exe 2528 reg.exe 1076 reg.exe 2544 reg.exe 2220 reg.exe 2860 reg.exe 1544 reg.exe 2960 reg.exe 2644 reg.exe 2748 reg.exe 648 reg.exe 888 reg.exe 344 reg.exe 1916 reg.exe 2228 reg.exe 1112 reg.exe 2508 reg.exe 1728 reg.exe 884 reg.exe 584 reg.exe 836 reg.exe 1168 reg.exe 584 reg.exe 3016 reg.exe 2208 reg.exe 1676 reg.exe 2512 reg.exe 652 reg.exe 1956 reg.exe 1508 reg.exe 1168 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1916 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1916 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1176 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1176 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2692 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2692 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2320 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2320 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1520 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1520 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1996 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1996 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1688 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1688 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 676 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 676 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1544 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1544 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1656 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1656 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2428 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2428 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2584 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2584 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2376 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2376 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2288 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2288 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1740 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1740 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 860 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 860 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2596 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2596 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2668 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2668 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1600 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1600 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2404 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2404 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 592 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 592 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 544 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 544 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1664 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1664 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2128 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2128 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1076 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1076 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1728 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1728 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 484 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 484 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2040 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2040 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1964 NmEckgIM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe 1964 NmEckgIM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1964 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 28 PID 2200 wrote to memory of 1964 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 28 PID 2200 wrote to memory of 1964 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 28 PID 2200 wrote to memory of 1964 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 28 PID 2200 wrote to memory of 2504 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 29 PID 2200 wrote to memory of 2504 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 29 PID 2200 wrote to memory of 2504 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 29 PID 2200 wrote to memory of 2504 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 29 PID 2200 wrote to memory of 1280 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 30 PID 2200 wrote to memory of 1280 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 30 PID 2200 wrote to memory of 1280 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 30 PID 2200 wrote to memory of 1280 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 30 PID 1280 wrote to memory of 2548 1280 cmd.exe 33 PID 1280 wrote to memory of 2548 1280 cmd.exe 33 PID 1280 wrote to memory of 2548 1280 cmd.exe 33 PID 1280 wrote to memory of 2548 1280 cmd.exe 33 PID 2200 wrote to memory of 2620 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 32 PID 2200 wrote to memory of 2620 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 32 PID 2200 wrote to memory of 2620 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 32 PID 2200 wrote to memory of 2620 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 32 PID 2200 wrote to memory of 2596 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 34 PID 2200 wrote to memory of 2596 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 34 PID 2200 wrote to memory of 2596 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 34 PID 2200 wrote to memory of 2596 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 34 PID 2200 wrote to memory of 2816 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 37 PID 2200 wrote to memory of 2816 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 37 PID 2200 wrote to memory of 2816 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 37 PID 2200 wrote to memory of 2816 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 37 PID 2200 wrote to memory of 2524 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 38 PID 2200 wrote to memory of 2524 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 38 PID 2200 wrote to memory of 2524 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 38 PID 2200 wrote to memory of 2524 2200 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 38 PID 2524 wrote to memory of 2416 2524 cmd.exe 41 PID 2524 wrote to memory of 2416 2524 cmd.exe 41 PID 2524 wrote to memory of 2416 2524 cmd.exe 41 PID 2524 wrote to memory of 2416 2524 cmd.exe 41 PID 2548 wrote to memory of 2920 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 42 PID 2548 wrote to memory of 2920 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 42 PID 2548 wrote to memory of 2920 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 42 PID 2548 wrote to memory of 2920 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 42 PID 2920 wrote to memory of 1916 2920 cmd.exe 44 PID 2920 wrote to memory of 1916 2920 cmd.exe 44 PID 2920 wrote to memory of 1916 2920 cmd.exe 44 PID 2920 wrote to memory of 1916 2920 cmd.exe 44 PID 2548 wrote to memory of 816 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 45 PID 2548 wrote to memory of 816 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 45 PID 2548 wrote to memory of 816 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 45 PID 2548 wrote to memory of 816 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 45 PID 2548 wrote to memory of 812 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 46 PID 2548 wrote to memory of 812 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 46 PID 2548 wrote to memory of 812 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 46 PID 2548 wrote to memory of 812 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 46 PID 2548 wrote to memory of 1980 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 47 PID 2548 wrote to memory of 1980 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 47 PID 2548 wrote to memory of 1980 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 47 PID 2548 wrote to memory of 1980 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 47 PID 2548 wrote to memory of 272 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 48 PID 2548 wrote to memory of 272 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 48 PID 2548 wrote to memory of 272 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 48 PID 2548 wrote to memory of 272 2548 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 48 PID 272 wrote to memory of 320 272 cmd.exe 53 PID 272 wrote to memory of 320 272 cmd.exe 53 PID 272 wrote to memory of 320 272 cmd.exe 53 PID 272 wrote to memory of 320 272 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\qwwckscw\NmEckgIM.exe"C:\Users\Admin\qwwckscw\NmEckgIM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1964
-
-
C:\ProgramData\NCcAAEks\guwMkQcM.exe"C:\ProgramData\NCcAAEks\guwMkQcM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2504
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"6⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"8⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"10⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"12⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"14⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"16⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"18⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"20⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"22⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"24⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"26⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"28⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"30⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"32⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"34⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"36⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:860 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"38⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"40⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"42⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"44⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"46⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:592 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"48⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"50⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"52⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"54⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"56⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"58⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:484 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"60⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"62⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"64⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock65⤵PID:1316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"66⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock67⤵PID:1864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"68⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock69⤵PID:1028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"70⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock71⤵
- Adds Run key to start application
PID:2144 -
C:\Users\Admin\WoYsMcQM\LUMwYYcI.exe"C:\Users\Admin\WoYsMcQM\LUMwYYcI.exe"72⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 3673⤵
- Program crash
PID:1688
-
-
-
C:\ProgramData\kGEksokQ\scAsoEsw.exe"C:\ProgramData\kGEksokQ\scAsoEsw.exe"72⤵PID:2804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 3673⤵
- Program crash
PID:2932
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"72⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock73⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"74⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock75⤵PID:896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"76⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock77⤵PID:2996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"78⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock79⤵PID:1728
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"80⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock81⤵PID:2584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"82⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock83⤵PID:568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"84⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock85⤵PID:2228
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock87⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"88⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock89⤵PID:3036
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"90⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock91⤵PID:1656
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"92⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock93⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"94⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock95⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"96⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock97⤵PID:796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"98⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock99⤵PID:1548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"100⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock101⤵PID:768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"102⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock103⤵PID:1756
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"104⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock105⤵PID:2844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock107⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"108⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock109⤵PID:2172
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"110⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock111⤵PID:1764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"112⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock113⤵PID:344
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"114⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock115⤵PID:2920
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"116⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock117⤵PID:1384
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"118⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock119⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"120⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock121⤵PID:2212
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-