Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe
-
Size
117KB
-
MD5
e0d4f805362cc919b44ae474f88181ae
-
SHA1
7e2dc060f2d2f15f8080eb7f40db1cb585179899
-
SHA256
be2a06101382c105d31982aad11e308d36f5e110099b0e78a2ec22ba486c98d9
-
SHA512
483d7315ec99900db4fe7986a2b37f3769c341d68c514d404a0d63432b70e59fff3593d9839d5260d68a2535b097bd764a1e8bf807e843de2cccf5d2bc2f1834
-
SSDEEP
3072:YNPjSo30AgPyCqaBTx/PUxaxCxQ1wwJPf/6O:gPZ3oqWPvxxWiPfCO
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation YyQMkQkM.exe -
Executes dropped EXE 2 IoCs
pid Process 4340 YyQMkQkM.exe 2656 PuMogUIg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PuMogUIg.exe = "C:\\ProgramData\\XIUQsgkk\\PuMogUIg.exe" 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YyQMkQkM.exe = "C:\\Users\\Admin\\VOAYAEAQ\\YyQMkQkM.exe" YyQMkQkM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PuMogUIg.exe = "C:\\ProgramData\\XIUQsgkk\\PuMogUIg.exe" PuMogUIg.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YyQMkQkM.exe = "C:\\Users\\Admin\\VOAYAEAQ\\YyQMkQkM.exe" 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe YyQMkQkM.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe YyQMkQkM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1580 reg.exe 4228 reg.exe 5376 reg.exe 1816 reg.exe 960 reg.exe 3156 reg.exe 5068 reg.exe 5564 reg.exe 3036 reg.exe 3252 reg.exe 4212 reg.exe 5476 reg.exe 4568 reg.exe 1580 reg.exe 1444 reg.exe 4500 reg.exe 1380 reg.exe 2368 reg.exe 1080 reg.exe 4960 reg.exe 4200 reg.exe 3804 reg.exe 5420 reg.exe 5380 reg.exe 5780 reg.exe 1992 reg.exe 2856 reg.exe 2224 reg.exe 5016 reg.exe 5396 reg.exe 4588 reg.exe 4988 reg.exe 2016 reg.exe 412 reg.exe 3268 reg.exe 4828 reg.exe 5984 reg.exe 5684 reg.exe 4020 reg.exe 3124 reg.exe 4828 reg.exe 5464 reg.exe 996 reg.exe 5308 reg.exe 5612 reg.exe 6056 reg.exe 1264 reg.exe 5440 reg.exe 2612 reg.exe 2208 reg.exe 3904 reg.exe 4900 reg.exe 1276 reg.exe 4544 reg.exe 4380 reg.exe 740 reg.exe 4372 reg.exe 4912 reg.exe 5032 reg.exe 1644 reg.exe 4616 reg.exe 5368 reg.exe 3932 reg.exe 5024 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5080 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5080 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5080 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5080 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3732 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3732 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3732 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3732 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 1740 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 1740 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 1740 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 1740 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2884 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2884 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2884 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2884 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4016 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4016 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4016 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4016 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3844 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3844 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3844 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3844 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 388 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 388 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 388 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 388 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2756 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2756 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2756 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 2756 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 548 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 548 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 548 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 548 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5204 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5204 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5204 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 5204 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3724 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3724 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3724 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 3724 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 944 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 944 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 944 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 944 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4900 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4900 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4900 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 4900 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4340 YyQMkQkM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe 4340 YyQMkQkM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3224 wrote to memory of 4340 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 88 PID 3224 wrote to memory of 4340 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 88 PID 3224 wrote to memory of 4340 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 88 PID 3224 wrote to memory of 2656 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 89 PID 3224 wrote to memory of 2656 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 89 PID 3224 wrote to memory of 2656 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 89 PID 3224 wrote to memory of 1132 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 90 PID 3224 wrote to memory of 1132 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 90 PID 3224 wrote to memory of 1132 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 90 PID 3224 wrote to memory of 3036 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 93 PID 3224 wrote to memory of 3036 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 93 PID 3224 wrote to memory of 3036 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 93 PID 3224 wrote to memory of 2368 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 94 PID 3224 wrote to memory of 2368 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 94 PID 3224 wrote to memory of 2368 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 94 PID 3224 wrote to memory of 1580 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 95 PID 3224 wrote to memory of 1580 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 95 PID 3224 wrote to memory of 1580 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 95 PID 3224 wrote to memory of 5832 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 96 PID 3224 wrote to memory of 5832 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 96 PID 3224 wrote to memory of 5832 3224 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 96 PID 1132 wrote to memory of 4544 1132 cmd.exe 101 PID 1132 wrote to memory of 4544 1132 cmd.exe 101 PID 1132 wrote to memory of 4544 1132 cmd.exe 101 PID 5832 wrote to memory of 2028 5832 cmd.exe 102 PID 5832 wrote to memory of 2028 5832 cmd.exe 102 PID 5832 wrote to memory of 2028 5832 cmd.exe 102 PID 4544 wrote to memory of 1548 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 103 PID 4544 wrote to memory of 1548 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 103 PID 4544 wrote to memory of 1548 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 103 PID 1548 wrote to memory of 6064 1548 cmd.exe 105 PID 1548 wrote to memory of 6064 1548 cmd.exe 105 PID 1548 wrote to memory of 6064 1548 cmd.exe 105 PID 4544 wrote to memory of 5368 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 106 PID 4544 wrote to memory of 5368 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 106 PID 4544 wrote to memory of 5368 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 106 PID 4544 wrote to memory of 5328 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 107 PID 4544 wrote to memory of 5328 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 107 PID 4544 wrote to memory of 5328 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 107 PID 4544 wrote to memory of 5356 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 108 PID 4544 wrote to memory of 5356 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 108 PID 4544 wrote to memory of 5356 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 108 PID 4544 wrote to memory of 5184 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 109 PID 4544 wrote to memory of 5184 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 109 PID 4544 wrote to memory of 5184 4544 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 109 PID 6064 wrote to memory of 3060 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 114 PID 6064 wrote to memory of 3060 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 114 PID 6064 wrote to memory of 3060 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 114 PID 5184 wrote to memory of 5416 5184 cmd.exe 116 PID 5184 wrote to memory of 5416 5184 cmd.exe 116 PID 5184 wrote to memory of 5416 5184 cmd.exe 116 PID 3060 wrote to memory of 5080 3060 cmd.exe 117 PID 3060 wrote to memory of 5080 3060 cmd.exe 117 PID 3060 wrote to memory of 5080 3060 cmd.exe 117 PID 6064 wrote to memory of 4488 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 118 PID 6064 wrote to memory of 4488 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 118 PID 6064 wrote to memory of 4488 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 118 PID 6064 wrote to memory of 4856 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 119 PID 6064 wrote to memory of 4856 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 119 PID 6064 wrote to memory of 4856 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 119 PID 6064 wrote to memory of 4568 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 120 PID 6064 wrote to memory of 4568 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 120 PID 6064 wrote to memory of 4568 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 120 PID 6064 wrote to memory of 3280 6064 2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\VOAYAEAQ\YyQMkQkM.exe"C:\Users\Admin\VOAYAEAQ\YyQMkQkM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4340
-
-
C:\ProgramData\XIUQsgkk\PuMogUIg.exe"C:\ProgramData\XIUQsgkk\PuMogUIg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"8⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"10⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"12⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"14⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"16⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"18⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"20⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"22⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"24⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"26⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"28⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"30⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"32⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock33⤵PID:5984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"34⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock35⤵PID:208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"36⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock37⤵PID:3888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"38⤵PID:2596
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock39⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"40⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock41⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"42⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock43⤵PID:5656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"44⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock45⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"46⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock47⤵PID:100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"48⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock49⤵PID:3556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"50⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock51⤵PID:1524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"52⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock53⤵PID:1704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"54⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock55⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"56⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock57⤵PID:5224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"58⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock59⤵PID:3944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"60⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock61⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"62⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock63⤵PID:4204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"64⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock65⤵PID:4544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"66⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock67⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"68⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock69⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"70⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock71⤵PID:3560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"72⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock73⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock75⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"76⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock77⤵PID:3356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"78⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock79⤵PID:2128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"80⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock81⤵PID:2972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"82⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock83⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"84⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock85⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"86⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock87⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"88⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock89⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"90⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock91⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock93⤵PID:2116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"94⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock95⤵PID:1244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"96⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock97⤵PID:5492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"98⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock99⤵PID:3376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"100⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock101⤵PID:2144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"102⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock103⤵PID:4440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"104⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock105⤵PID:1536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"106⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock107⤵PID:5180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"108⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock109⤵PID:3436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"110⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock111⤵PID:6136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"112⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock113⤵PID:5664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"114⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock115⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"116⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock117⤵PID:2416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"118⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock119⤵PID:1460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"120⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock121⤵PID:5300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_e0d4f805362cc919b44ae474f88181ae_virlock"122⤵PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-