Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 11:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
-
Size
196KB
-
MD5
638ebaf1bea8850ca9ada168c65de1c6
-
SHA1
1bbcefb36ffab914c5606d3c944e1c3a493a1d78
-
SHA256
b3433542361a92fee7c35339e42ed35682151e1cb7c94116f0259a19954b1f76
-
SHA512
ca7242c7dbf8d44b0371b5063f65652298d84e00bb684f4416eeef34249075d66a3b1651528c7d1acadbdf7e3e6ae930cab8e86b2e1691335782806c15d9c3dc
-
SSDEEP
3072:lPfoxhGuluhBNIyOZt6T5e2GsFEjyKItKJximQdHpTEOA3SNP8PA:x2GIy+6T57GsFEv3JAmahUOP8Y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AskkUIYk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\International\Geo\Nation AskkUIYk.exe -
Executes dropped EXE 2 IoCs
Processes:
AygsgEAk.exeAskkUIYk.exepid process 3032 AygsgEAk.exe 2744 AskkUIYk.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeAskkUIYk.exepid process 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeAskkUIYk.exeAygsgEAk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\AygsgEAk.exe = "C:\\Users\\Admin\\AwQscoAU\\AygsgEAk.exe" 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AskkUIYk.exe = "C:\\ProgramData\\kKowoQwU\\AskkUIYk.exe" 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AskkUIYk.exe = "C:\\ProgramData\\kKowoQwU\\AskkUIYk.exe" AskkUIYk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\AygsgEAk.exe = "C:\\Users\\Admin\\AwQscoAU\\AygsgEAk.exe" AygsgEAk.exe -
Drops file in Windows directory 1 IoCs
Processes:
AskkUIYk.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico AskkUIYk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1572 reg.exe 2136 reg.exe 1660 reg.exe 1596 reg.exe 2792 reg.exe 1616 reg.exe 2116 reg.exe 2588 reg.exe 2612 reg.exe 2460 reg.exe 284 reg.exe 1856 reg.exe 1044 reg.exe 2856 reg.exe 600 reg.exe 1652 reg.exe 1736 reg.exe 1596 reg.exe 2552 reg.exe 2524 reg.exe 3028 reg.exe 1240 reg.exe 1600 reg.exe 2044 reg.exe 1888 reg.exe 1988 reg.exe 2936 reg.exe 1012 reg.exe 2504 reg.exe 708 reg.exe 1892 reg.exe 1996 reg.exe 2836 reg.exe 2752 reg.exe 2572 reg.exe 2120 reg.exe 1548 reg.exe 2548 reg.exe 2720 reg.exe 1184 reg.exe 2284 reg.exe 836 reg.exe 912 reg.exe 2584 reg.exe 1100 reg.exe 552 reg.exe 2548 reg.exe 1624 reg.exe 2116 reg.exe 2148 reg.exe 1728 reg.exe 3028 reg.exe 1052 reg.exe 832 reg.exe 828 reg.exe 2456 reg.exe 2636 reg.exe 2732 reg.exe 2816 reg.exe 2844 reg.exe 1668 reg.exe 2300 reg.exe 2624 reg.exe 2932 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exepid process 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2816 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2816 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2704 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2704 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1716 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1716 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1680 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1680 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1280 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1280 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2708 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2708 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2336 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2336 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2524 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2524 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2536 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2536 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2600 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2600 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1996 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1996 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1780 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1780 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1884 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1884 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1928 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1928 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2980 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2980 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2720 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2720 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 380 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 380 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2032 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2032 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1172 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1172 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 488 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 488 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2604 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2604 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2832 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2832 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1068 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1068 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2848 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2848 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2212 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2212 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1756 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1756 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2128 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2128 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AskkUIYk.exepid process 2744 AskkUIYk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
AskkUIYk.exepid process 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe 2744 AskkUIYk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.execmd.execmd.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.execmd.execmd.exedescription pid process target process PID 2240 wrote to memory of 3032 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AygsgEAk.exe PID 2240 wrote to memory of 3032 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AygsgEAk.exe PID 2240 wrote to memory of 3032 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AygsgEAk.exe PID 2240 wrote to memory of 3032 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AygsgEAk.exe PID 2240 wrote to memory of 2744 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AskkUIYk.exe PID 2240 wrote to memory of 2744 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AskkUIYk.exe PID 2240 wrote to memory of 2744 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AskkUIYk.exe PID 2240 wrote to memory of 2744 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe AskkUIYk.exe PID 2240 wrote to memory of 2680 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2680 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2680 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2680 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2680 wrote to memory of 3008 2680 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2680 wrote to memory of 3008 2680 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2680 wrote to memory of 3008 2680 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2680 wrote to memory of 3008 2680 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2240 wrote to memory of 2560 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2560 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2560 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2560 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2836 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2836 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2836 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2836 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2708 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2708 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2708 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2708 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2240 wrote to memory of 2492 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2492 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2492 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2240 wrote to memory of 2492 2240 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2492 wrote to memory of 2520 2492 cmd.exe cscript.exe PID 2492 wrote to memory of 2520 2492 cmd.exe cscript.exe PID 2492 wrote to memory of 2520 2492 cmd.exe cscript.exe PID 2492 wrote to memory of 2520 2492 cmd.exe cscript.exe PID 3008 wrote to memory of 2788 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2788 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2788 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2788 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2788 wrote to memory of 2816 2788 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2788 wrote to memory of 2816 2788 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2788 wrote to memory of 2816 2788 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2788 wrote to memory of 2816 2788 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3008 wrote to memory of 2932 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2932 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2932 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2932 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2964 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2964 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2964 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2964 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2148 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2148 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2148 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2148 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3008 wrote to memory of 2004 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2004 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2004 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3008 wrote to memory of 2004 3008 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2004 wrote to memory of 2348 2004 cmd.exe cscript.exe PID 2004 wrote to memory of 2348 2004 cmd.exe cscript.exe PID 2004 wrote to memory of 2348 2004 cmd.exe cscript.exe PID 2004 wrote to memory of 2348 2004 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AwQscoAU\AygsgEAk.exe"C:\Users\Admin\AwQscoAU\AygsgEAk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3032 -
C:\ProgramData\kKowoQwU\AskkUIYk.exe"C:\ProgramData\kKowoQwU\AskkUIYk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"6⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"8⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"10⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"12⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"14⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"16⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"18⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"20⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"22⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1244 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"24⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"26⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"28⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"30⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"32⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"34⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"36⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"38⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"40⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:380 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"42⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"44⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"46⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"48⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"50⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"52⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"54⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"56⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"58⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"60⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"62⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"64⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock65⤵PID:2464
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"66⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock67⤵PID:872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"68⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock69⤵PID:2040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"70⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock71⤵PID:1720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"72⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock73⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"74⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock75⤵PID:2456
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"76⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock77⤵PID:2600
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock79⤵PID:1448
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"80⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock81⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"82⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock83⤵PID:324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"84⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock85⤵PID:1244
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"86⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock87⤵PID:2772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"88⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock89⤵PID:2708
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"90⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock91⤵PID:1072
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"92⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock93⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"94⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock95⤵PID:1500
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"96⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock97⤵PID:1464
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"98⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock99⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock101⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock103⤵PID:1680
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock105⤵PID:1988
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"106⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock107⤵PID:1504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"108⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock109⤵PID:1880
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"110⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock111⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"112⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock113⤵PID:2816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"114⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock115⤵PID:1240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"116⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock117⤵PID:2132
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock119⤵PID:452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"120⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock121⤵PID:1896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"122⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock123⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"124⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock125⤵PID:2712
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"126⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock127⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"128⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock129⤵PID:768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"130⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock131⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"132⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock133⤵PID:1056
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"134⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock135⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"136⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock137⤵PID:1068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"138⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock139⤵PID:1828
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"140⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock141⤵PID:1124
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"142⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock143⤵PID:320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"144⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock145⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"146⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock147⤵PID:1572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"148⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock149⤵PID:2816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"150⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock151⤵PID:1580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"152⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock153⤵PID:2240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"154⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock155⤵PID:2460
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"156⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock157⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"158⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock159⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"160⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock161⤵PID:1676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"162⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock163⤵PID:2216
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"164⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock165⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"166⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock167⤵PID:2136
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"168⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock169⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"170⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock171⤵PID:2656
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"172⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock173⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"174⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock175⤵PID:1084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"176⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock177⤵PID:2724
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"178⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock179⤵PID:2344
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"180⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock181⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"182⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock183⤵PID:1920
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"184⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock185⤵PID:864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"186⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock187⤵PID:412
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"188⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock189⤵PID:2612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"190⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock191⤵PID:644
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"192⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock193⤵PID:2216
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"194⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock195⤵PID:2660
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"196⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock197⤵PID:2072
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"198⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock199⤵PID:1448
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"200⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock201⤵PID:2320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"202⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock203⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"204⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock205⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"206⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock207⤵PID:2080
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"208⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock209⤵PID:2964
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"210⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock211⤵PID:1772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"212⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock213⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"214⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock215⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"216⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock217⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"218⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock219⤵PID:804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"220⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock221⤵PID:1692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"222⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock223⤵PID:1324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"224⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock225⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"226⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock227⤵PID:1828
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"228⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock229⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"230⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock231⤵PID:2300
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"232⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock233⤵PID:1056
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"234⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock235⤵PID:2816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"236⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock237⤵PID:624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"238⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock239⤵PID:1896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"240⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock241⤵PID:2212
-